fires when
Use when asked to draw, sketch, map, diagram, visualize, or make a picture/schema/architecture of how software works — the architecture or how-it-works view of a feature, the relationships between classes or interfaces (with their methods and fields), data or record flow, an object model with its fields and permission sets, or a dependency graph — for a package, a feature, a handful of files, or a whole undocumented source directory, built from a spec, a plan or ticket, or read straight from the code, and output as one shareable HTML page you can commit. Also use to clean up an existing generated diagram that is hard to read (overlapping nodes, tiny text). Do NOT use to plot a data or metrics chart from a dataset, to paste a mermaid or ascii snippet into a PR or README, to draw in an external editor like Lucidchart or Excalidraw, to convert a whiteboard photo, to re-render an existing page for a screenshot, or to explain how something works in words with no picture.
best for
Teams who want an accurate, clickable "how it works" diagram (classes/objects/components/permission sets + relations) committed alongside a spec or module — with a heterogeneous mix of node kinds (react / apex / lambda / object) kept visually distinct — instead of a hand-drawn or memory-derived picture.
measured · trigger
best score
17/23
description-triggeringaccuracy
74%
vs baseline 44% measured 2026-09-08
measured · quality
Not measured yet. A quality number needs its own eval: 15 or more tasks, each run with the skill and without it.
security scan · 8/8
✓prompt-injectionNo directives aimed at the reading model; SKILL.md/sextant.md are legitimate agent-role instructions, not injected overrides.
✓data-exfiltrationshot.mjs only screenshots a local file:// page and writes a local PNG; no network send of repo/user data.
✓secret-detectionNo keys/tokens/credentials found in any material file.
✓dangerous-commandsNo rm -rf/force-push/dd/chmod-777; scripts only mkdirSync/readFileSync/writeFileSync on given paths.
✓obfuscationAll JS is plain readable Node/browser code; no base64/hex payloads or eval of decoded blobs.
✓external-fetchesTemplate loads React/ReactFlow/elkjs from esm.sh and fonts from Google Fonts CDN — expected, documented rendering deps, not a hidden fetch-and-run.
✓credential-accessNo reads of ~/.ssh, ~/.aws, .env, keychain, or cookie stores anywhere in the scripts.
✓privilege-escalationNo sudo, setuid, or cron/profile/launch-agent persistence edits.
scanned 2026-09-08 · cerberus:security-scan
side effects & deps
filesnetwork
needsnothing
what’s inside
SKILL.md14.5 KB
metadata.yaml1.2 KB
evals/RESULTS.md3.1 KB
evals/result.json8.9 KB
evals/rubric.json5.7 KB
references/build-spec-diagram.mjs7.4 KB
references/color-encoding-research.md10.7 KB
references/diagram-viewer.template.html44.3 KB
references/readability-rules.md8.7 KB
references/sextant.md8.1 KB
references/shot.mjs4.1 KB