diagram

An agent skill by garrytan, from garrytan/gstack. Tags: diagrams, documentation, visualization.

What it does

Turn an English description (or mermaid source) into a diagram triplet: the source, an editable .excalidraw file you can open on excalidraw.com, and rendered SVG + PNG. (gstack)

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add garrytan/gstack --skill diagram

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/garrytan/gstack
cp -r gstack/diagram ~/.claude/skills/diagram

Safety box score

Grade C, moderate risk: 35 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill generates local diagram artifacts from Mermaid or English, rendering a `.mmd`, `.excalidraw`, `.svg`, and `.png` triplet. The main risks are local command execution, writes into home-directory state for staging and telemetry, and delegated behavior in helper scripts that are not visible in this markdown.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It shells out to `~/.claude/skills/gstack/bin/gstack-skill-start`, `bun run ... gstack-render.ts` with `--eval`, and `gstack-skill-end`, so it runs local commands and browser-side code.
Network access	0 (none)	The skill explicitly says `Fully offline` and `No CDN, no network`, and the visible commands do not contact remote hosts.
Filesystem reach	2 (moderate)	It writes artifacts to `./diagrams/` or `/tmp/gstack-diagrams/`, stages render files under `${TMPDIR:-/tmp}/gstack-render`, and logs telemetry to `$GSTACK_STATE_ROOT/analytics/`.
Secrets & credentials	0 (none)	No tokens, passwords, `.env` files, keychains, or browser sessions are read or requested in the visible workflow.
Privilege & persistence	0 (none)	There is no `sudo`, global install, service registration, shell startup edit, or other privilege-changing step in the visible instructions.
Instruction hijack surface	2 (moderate)	It tells the agent to treat the skill file as executable instructions and to honor `GSTACK_INSTRUCTION_BEGIN` blocks from tool output, which is an instruction-fetch mechanism.
Irreversible actions	1 (low)	The skill only creates local diagram artifacts and logs telemetry; it does not post, deploy, pay, or delete anything external.
Transparency	2 (moderate)	Core behavior is delegated to uninspected helpers and a bundled renderer (`gstack-skill-start`, `gstack-render.ts`, `gstack-skill-end`) not shown here, so some effects are outside the reviewed file.

Before installing

Read `~/.claude/skills/gstack/bin/gstack-skill-start`, `gstack-render.ts`, and `gstack-skill-end` before trusting the skill.
Confirm the telemetry write target `{$GSTACK_STATE_ROOT}/analytics/` is acceptable in your environment.
Test once in a scratch repo and verify it only creates the expected diagram files and temp staging files.
Make sure the bundled renderer is present and that you are okay with the skill stopping if Aside or the fallback browser is unavailable.

Rated 2026-10-16 by an automated review of 1 file from the skill's repository.

Source

Repository: garrytan/gstack (all skills from this repository)
Path: diagram/SKILL.md
Branch: main
Updated: 2026-10-05

crypto-protocol-diagram — Extracts protocol message flow from source code, RFCs, academic papers, pseudocode, informal prose, ProVerif (.pv).
mermaid-tools — Extracts Mermaid diagrams from markdown files and generates high-quality PNG images using bundled scripts.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
automate-me — Use for "automate me", "create/update/refresh my -mode skill", "turn/capture my preferences or working style into a skill".
continual-learning — Orchestrate continual learning by delegating transcript mining and AGENTS.md updates to `agents-memory-updater`.
copy-editing — When the user wants to edit, review, or improve existing marketing copy, or refresh outdated content.