一键在 Manus 中运行任何 Skill

drawio

星标2

分支0

更新时间2026年5月30日 19:15

General draw.io diagram creation via MCP tools. Covers the three tool types (Mermaid, XML, CSV), URL presentation rules for the Hermes WebUI, Mermaid syntax reference shortcuts, domain-specific palettes (executive/boardroom Gartner-style), and when to prefer each tool type. Use for any draw.io task that doesn't fit a domain-specific skill (intana-viz, architecture-diagram, etc.). Load this skill when the user asks for a draw.io diagram, a Mermaid diagram for draw.io, or any visualization using the draw.io MCP tools.

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

norandom

norandom/Skills

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

相关职业SOC

基于 SOC 职业分类

软件开发工程师计算机与数学类职业·SOC 15-1252

文件资源管理器

4 个文件

SKILL.md

readonly

同仓库更多 Skills

同仓库

corporate-finance

norandom/Skills

Corporate finance and financial-modeling workbench for spreadsheets, analysis, advice, and model review. Covers EBITDA, ratios, common-size/trend analysis, 3-statement models, cash-flow statements, 13-week forecasts, working capital/CCC, DCF/WACC/valuation, and budgeting. Produces XLSX / Claude-for-Excel workbooks with assumption sheets, validation checks, color-coded inputs, auditable formula traces, and Python recalculation checks. Triggers on "build a financial model", "make a budget", "3-statement model", "DCF", "WACC", "valuation", "cash flow forecast", "ratio analysis", "EBITDA", "common-size", "P&L template", or model review. Every stated number needs source, formula, substitution, units, result, Python verification, and mismatch status. Skip for bookkeeping entries, tax filing, or personal-finance budgeting.

2026-06-112

cobesy

norandom/Skills

COBESY (Cognitive Behavioral Systemic) helps an agent turn static knowledge (docs, repos, architecture, decks) into work people actually adopt. It checks the culture first (Schein assumptions, Edmondson safety, Scientist Mode), then compresses the message (Minto, Dirksen, Knowles), then plans how adoption moves through the network (Centola, Jackson, Berger REDUCE, cascades). The same cognitive engine also structures written and projected artifacts: blog posts (technical and financial), a thesis, journal article, or slides, with a skeleton grid, headlines, bullets, emphasis, writing advice, style guidance, and keywords before prose (Belcher, Cron, Kolin, Graff & Birkenstein, Klinkenborg, Williams & Bizup). Use it for rollouts, buy-in, change management, briefings, resistance, onboarding, or to structure a piece of writing where the knowledge is there but the structure keeps getting lost. Skip it for factual lookup or single-fact Q&A.

2026-06-112

game-theory-negotiation

norandom/Skills

Negotiation and auction playbook for bargaining, procurement, and incentive design. Covers reservation price, BATNA, ZOPA, surplus, aspiration ladder, degressive concessions, counter-offers, nibble defense, higher-authority commitments, virtual price lists, holdup protection, fairness checks, Vickrey mechanisms, negotiauctions, profit-share sizing, and draw.io maps of players, incentives, moves, and payoffs. Triggers on requests to prepare for or run a negotiation, choose an opening offer or concession pattern, defend a walk-away price, improve a BATNA, structure a tender, design a bonus, split something fairly, or visualize a negotiation as a game. Also fires on "help me negotiate", "BATNA", "ZOPA", "reservation price", "degressive bidding", "negotiauction", "game tree", "payoff matrix", and on salary, vendor/procurement, M&A earnout, and security-compliance negotiations. Skip for general game-theory homework unrelated to bargaining, auctions, or contracting.

2026-05-312

intana-viz

norandom/Skills

Create intelligence analysis visualizations using draw.io diagrams. Covers 80+ structured analytic techniques including: ACH, Argument Mapping, String of Pearls, Critical Path, CoA Analysis, Pre-Mortem, Red Teaming, Four Ways of Seeing, Devil's Advocacy, Prioritisation Maps, If/Then matrices, Bias catalogs, Opportunity matrices, McKinsey 7S, Cultural Web, Leavitt's Diamond, Fishbone, Futures Wheel, Six Thinking Hats, Key Assumptions Check, Blindspot Analysis, Framestorming, War Gaming, and more. Use this skill whenever the user asks for any intelligence analysis chart, diagram, matrix, framework visualization, structured analytic technique visualization, or analytical model rendering — even if they don't name a specific technique. Also trigger for risk assessments, decision matrices, stakeholder analysis, assumption mapping, scenario planning, wargaming, root cause analysis, or any structured thinking framework.

2026-05-302

investigation-theory

norandom/Skills

Unified SOC / DFIR workflow rooted in Investigation Theory (Diagnostic Inquiry): six-stage loop, question taxonomy (preceding / context / succeeding / proximate / capability-matching / utility), GAPSS data manipulation, three-tier escalation, modified CJCSM 6510 dispositions, Once Upon a Time compromise report, Security M&M peer review, and five standard draw.io diagrams. Triggers on alert triage, log analysis (proxy / mail / Windows / Sysmon / EDR / NetFlow), phishing, lateral movement, C2 / beaconing, data exfiltration, malware execution, insider threats, and on requests to write case notes, playbooks, attack timelines, dispositions, compromise reports, or run an M&M peer review. Also fires on prompts like "help me investigate this alert", "how do I analyze these logs", "build me a playbook for X", "what questions should I ask", "document this incident", or mentions of SOC workflows, triage queues, or incident severity. Does not fire on detection engineering or offensive / red-team work.

2026-05-302

premortem

norandom/Skills

Stress-test a concrete plan, launch, hire, pricing change, strategy, or commitment by assuming it has already failed and reasoning backward. Use when the user has a real decision on the table and asks to 'premortem' it, 'stress-test' it, 'find blind spots', 'poke holes', or otherwise wants honest failure analysis instead of validation. Skip for vague ideas (help them plan first), questions with one right answer, or decisions that are already irreversible.

2026-05-302

name	drawio
version	1.0.0
description	General draw.io diagram creation via MCP tools. Covers the three tool types (Mermaid, XML, CSV), URL presentation rules for the Hermes WebUI, Mermaid syntax reference shortcuts, domain-specific palettes (executive/boardroom Gartner-style), and when to prefer each tool type. Use for any draw.io task that doesn't fit a domain-specific skill (intana-viz, architecture-diagram, etc.). Load this skill when the user asks for a draw.io diagram, a Mermaid diagram for draw.io, or any visualization using the draw.io MCP tools.

Draw.io Diagram Creation

General-purpose draw.io diagramming via MCP tools. For domain-specific diagram types, load the relevant skill first (intana-viz for intelligence analysis, architecture-diagram for cloud/infra). For the executive/boardroom Gartner-style palette, see the Domain-Specific Palettes section below.

Available MCP Tools

Tool	Best For	Output
`mcp_drawio_open_drawio_mermaid`	Flows, trees, sequences, state diagrams	Mermaid.js rendered in draw.io
`mcp_drawio_open_drawio_xml`	Spatial layouts, matrices, precise positioning	Native draw.io XML (mxGraphModel)
`mcp_drawio_open_drawio_csv`	Tabular data to diagram conversion	draw.io from CSV
`mcp_drawio_get_mermaid_reference`	Look up Mermaid syntax	Reference doc (call before mermaid tool)
`mcp_drawio_get_xml_reference`	Look up XML styles, shapes, edge routing	Reference doc (call before XML tool)

CRITICAL: Call Reference Tools Before Generating

Before open_drawio_mermaid: call get_mermaid_reference if unsure about syntax for a specific diagram type. Covers all 26 supported Mermaid types.
Before open_drawio_xml: ALWAYS call get_xml_reference first. Don't skip it — the XML reference is the source of truth for styles, shapes, edge routing rules, containers, layers, and the full property table. It returns ~30KB of Markdown.
Before open_drawio_csv: avoid CSV unless explicitly requested — it's unreliable. Prefer Mermaid for org charts and hierarchies.

Reference Files

File	Content
`references/xml-checklist.md`	Pre-flight checklist for XML generation (shadow=1, unescaped &, edge geometry, XML comments, etc.)
`references/gartner-palette.md`	Gartner-style risk palette: colors for Critical/High/Medium/Positive/Warning
`references/blindspot-pattern.md`	Blindspot-from-Premortem diagram pattern: hidden assumption → cascading failures → process assumptions

URL Presentation in Hermes WebUI (CRITICAL)

Draw.io URLs embed the entire diagram source in the URL fragment (#create= with %-encoded JSON). These URLs are very long (often thousands of characters).

Always present the bare URL on its own line. Do NOT wrap it in Markdown link syntax [text](url). The WebUI's Markdown renderer can mangle long URLs containing % escapes and # fragments, producing broken links the user cannot open.

https://draw.because-security.com/?grid=0&pv=0&border=10&edit=_blank#create=%7B...

The WebUI auto-linkifies bare URLs. This avoids all Markdown rendering corruption.

When the user explicitly asks for "a clickable link" or "just give me the link," give them ONLY the bare URL — no surrounding analysis text, no table, no prose. They asked for the diagram link, not an essay. After presenting the URL, mention what the diagram shows in 1-2 lines only.

Verification

After generating a diagram URL, curl-verify it returns 200:

curl -s -o /dev/null -w "%{http_code}" "<URL>"

If the URL returns 200 server-side but the user reports it's broken, the problem is in the WebUI's Markdown rendering, not the URL itself.

Mermaid Quick Reference

Call mcp_drawio_get_mermaid_reference before generating Mermaid diagrams. Key reminders:

Direction: TD/LR/RL/BT
Node shapes: [rect], (rounded), {rhombus}, ((circle)), [(cylinder)]
Edges: --> arrow, --- no arrow, -.-> dotted, ==> thick
Subgraphs: subgraph ID["Label"] ... end
Styling: style NODE fill:#xxx,stroke:#xxx,color:#xxx
Classes: classDef name fill:#xxx; class A,B name
Quotes: Use \" for labels with special characters (colons, parens)
No trailing punctuation on node IDs

When to Prefer XML Over Mermaid

Precise coordinates / custom positions
draw.io-native shapes (AWS, Azure, GCP, Cisco)
Mixed shape libraries or complex multi-layer diagrams
Anything needing exact per-element color variations at scale
Diagrams that will be extensively edited in draw.io after generation

Domain-Specific Palettes

Boardroom / Executive Palette (Gartner-Inspired)

For executive, compliance, and boardroom diagrams use a darker, more severe palette — authoritative navy, deep burgundy, rich amber — instead of default analytical colors. The Gartner look signals "sober risk analysis" rather than "collaborative workshop output."

Always load intana-viz first for the technique catalog and diagram templates. This palette is a styling layer on top.

Trigger: User says "business theme", "Gartner look", "executive style", "boardroom-ready", or audience is a board/C-suite/compliance committee/external regulator.

Color scheme (full spec in references/gartner-palette.md):

Role	Fill	Stroke	Text	Detail Text
Background	`#F8FAFC`	—	—	—
Title	—	—	`#0F172A` (16pt bold)	—
Central node	`#0F172A`	`#020617`	`#FFFFFF`	near-black navy
Critical	`#991B1B`	`#7F1D1D`	`#FFFFFF`	deep burgundy; detail `#FECACA`
High	`#B45309`	`#92400E`	`#FFFFFF`	rich amber; detail `#FDE68A`
Medium	`#6D28D9`	`#5B21B6`	`#FFFFFF`	deep violet; detail `#DDD6FE`
Low	`#64748B`	`#475569`	`#FFFFFF`	slate
Positive/Safe	`#D1FAE5`	`#059669`	`#047857`	(rarely used in boardroom context)
Warning	`#FEF3C7`	`#F59E0B`	`#B45309`	(rarely used in boardroom context)
Edges	—	`#94A3B8` (1.5pt)	—	no arrowheads
Legend border	—	`#E2E8F0` (1pt)	—	—

Note: shadow=1 is desirable on primary nodes for the executive look, but shadows in complex XML can cause "invalid distance too far back" decompression errors. See the XML Generation pitfall below — use single-line labels on first render, add details later.

Key difference from default analytical palette: Darker and more severe. No bright red (#DC2626), no bright green (#059669). Every color reads as a severity tier descending from critical to low. The central node uses near-black navy instead of dark slate.

Diagram types commonly used with this palette: Pre-Mortem Analysis, Key Assumptions Check, If/Then Analysis, Four Ways of Seeing (2×2), High Impact/Low Probability (2×2), Analysis of Competing Hypotheses (ACH).

Common Pitfalls

XML Generation

Before generating XML, run through references/xml-checklist.md — every item is a blocker the server will reject.

Most common XML failure: shadow=1 on nodes → "invalid distance too far back" error. Remove shadow=1 from ALL nodes and regenerate with plain-text values only.

Boardroom palette decompression failure: Complex XML with many HTML-escaped labels, long detail text, or deep nesting can produce a compression blob that fails decompression server-side. Fix: Regenerate with simpler labels — remove <br> detail lines, keep labels to 1-2 words per node, strip <font> subtags. The diagram structure and palette stay the same; only label complexity is reduced. Add detail text in draw.io's editor after opening. Prevention: For first render, use single-line labels with no HTML escaping. Add detail text in a second pass only after the diagram opens successfully.

Mermaid Generation

Cause: Misspelled diagram type keyword (e.g., flowchart vs flowchrt)
Fix: Check the type keyword — draw.io supports 26 types: flowchart, sequenceDiagram, classDiagram, stateDiagram-v2, erDiagram, gitGraph, journey, pie, gantt, mindmap, timeline, quadrantChart, requirementDiagram, sankey-beta, xychart-beta, block-beta, plus C4 and architecture variants