MCP, MCP server
Drawio Skill
Agent skill that turns natural language, code, Terraform/K8s, SQL, OpenAPI, AsyncAPI, Protobuf and GraphQL sources into editable, tested draw.io architecture diagrams: incremental sync, multi-view projection, drift diff, CI architecture tests, whiteboard derasterize, interactive
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 57270820d3cd, unchanged since the check below.
OBFUSCATION_MINIFIED_PAYLOAD
Why this grade
- OBFUSCATION_MINIFIED_PAYLOAD Medium
Contains a very long line with almost no spaces in a script or style file.
skills/drawio-skill/scripts/diagram_ir.py, line 1477
body{{font:16px system-ui;margin:0;background:#f7f8fa;color:#17202a}}header,main{{max-width:1200px;margin:auto;padding:18px}}.toolbar{{display:flex;gap:8px;align-items:center}}butt
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Note
requests shell access. The manifest names this permission.
PERMISSION_SHELL_DECLARED
examples/architecture-studio/generate.py, line 21
return subprocess.run(
examples/architecture-studio/generate.py, line 52
subprocess.run(
examples/hero-demo/build_hero_gif.py, line 31
subprocess.run(
Show more
skills/drawio-skill/scripts/autolayout.py, line 159
proc = subprocess.run(
skills/drawio-skill/scripts/buildup.py, line 304
r = subprocess.run(["drawio", "-x", "-f", "png", "--page-index", "1",
skills/drawio-skill/scripts/compress.py, line 174
r = subprocess.run(
skills/drawio-skill/scripts/diagramctl.py, line 186
proc = subprocess.run(cmd, text=True, capture_output=True)
skills/drawio-skill/scripts/diagramctl.py, line 250
p = subprocess.run(
Install and update
Pass
No install-time script found, and dependencies are pinned or absent.
Network
Concern
can reach a host that is not written as a fixed address.
NETWORK_NO_FIXED_HOST
skills/drawio-skill/scripts/aiicons.py, line 87
def fetch(url):
skills/drawio-skill/scripts/aiicons.py, line 88
return urllib.request.urlopen(safe_url(url), timeout=15).read()
skills/drawio-skill/scripts/aiicons.py, line 176
svg = fetch(url)
Show more
skills/drawio-skill/scripts/aiicons.py, line 198
svg = fetch(url)
skills/drawio-skill/scripts/dbxicons.py, line 152
with urllib.request.urlopen(req, timeout=30) as resp:
Secrets
Pass
No read of a credential file or secret environment variable found.
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Concern
contains a minified payload.
OBFUSCATION_MINIFIED_PAYLOAD
skills/drawio-skill/scripts/diagram_ir.py, line 1477
body{{font:16px system-ui;margin:0;background:#f7f8fa;color:#17202a}}header,main{{max-width:1200px;margin:auto;padding:18px}}.toolbar{{display:flex;gap:8px;align-items:center}}butt
skills/drawio-skill/scripts/diagram_ir.py, line 1479
const DATA={data};let i=-1;const nodes=[...document.querySelectorAll('.node')];function titleOf(s){{return (language.value&&s.labels&&s.labels[language.value])||s.title}}function s
Licence
Pass
A licence file is present (LICENSE).
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 57270820d3cd. requests shell access. The manifest names this permission. can reach a host that is not written as a fixed address. contains a minified payload.
Date and source
Date checked:
github.com
Commit graded: 57270820d3cd71cbdf4fb6b2f7091d4fb37bb019
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.