/architecture-diagram

name: architecture-diagram
description: >-
  Produce a security architecture, network, or trust-boundary diagram of a
  system, highlighting components, zones, controls, and exposure. Use when
  documenting a design review, network segmentation, or cloud architecture from
  a security perspective.

Goal

A diagram that makes the security-relevant structure legible: components, the zones/segments they sit in, the controls between them, and where the system is exposed.

Steps

1. Gather the components (services, gateways, data stores, identities) and how they connect. Ask for the design if not provided. 2. Group into **zones** (internet, edge/DMZ, app tier, data tier, management, each cloud account/VPC/namespace). Draw zone boundaries explicitly. 3. Annotate **controls** on the links: TLS, authn/authz, WAF, firewall rules, network policy, encryption-at-rest on stores. 4. Mark **exposure**: anything internet-reachable, public buckets, admin planes. 5. Render: prefer the Excalidraw MCP; otherwise emit Mermaid `flowchart` with `subgraph` per zone, plus DOT for tooling that prefers Graphviz.

Rendering contract (shared by all diagram skills)

• If an Excalidraw MCP server/tool is available, create the diagram there and

save/export it; tell the user the file location.

• Otherwise output, in this order: (a) a fenced ```mermaid block, (b) a fenced

`.excalidraw` JSON block the user can import at excalidraw.com, (c) for graphs, a ```dot block. Keep node labels short.

Output

• The diagram (rendered or importable).
• A legend mapping shapes/colors to zones and control types.
• A short "exposure & controls gaps" note for follow-up.