Conversation
…arkdown lint Replace xml.etree.ElementTree with defusedxml.ElementTree in all Python scripts to address Bandit B314/B405 and Semgrep XXE findings. Add nosec suppression to subprocess import in drawio_url.py (browser URL opener only). Fix 106 markdownlint errors (MD022/MD031/MD032 blank lines, MD001 heading levels) across 7 reference files and SKILL.md. Trim SKILL.md from 515 to 495 lines to satisfy the 500-line SKILL001 limit. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
mayakost
requested review from
a team,
krokoko,
scottschreckengaust and
theagenticguy
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
mayakost
changed the title
Move detailed XML generation rules and layout guidelines from SKILL.md (494 lines) into references/xml-generation-rules.md and references/layout-guidelines.md. SKILL.md is now 219 lines, well under the 300-line warning threshold enforced by SKILL001.
Run dprint fmt on 7 files (JSON and Markdown) that were not conforming to the project's formatting rules.
…sues - Replace defusedxml with stdlib xml.etree.ElementTree in all 5 Python scripts and validate-drawio.sh (XML is self-generated, no XXE risk) - Remove pip3 auto-install from PostToolUse hook - Remove unused import sys in fix_step_badges.py - Remove unused style variable in post_process_drawio.py fix_legend_size - Add explanatory comment to except block in post_process_drawio.py
…ples Delete 5 files (-2039 lines): - example-diagrams.md (803 lines): outdated XML examples conflicting with .drawio refs - aws-diagram-guidelines.md (536 lines): internal wiki copy, all rules in style-guide.md - xml-structure.md (209 lines): merged unique parts into group-styles.md + layout-guidelines.md - xml-generation-rules.md (186 lines): trimmed and renamed to xml-rules.md (89 lines) - aws4-shapes.md (231 lines): split into aws4-shapes-services.md (69) + aws4-shapes-resources.md (100) All reference files now under 100-line DESIGN_GUIDELINES limit. All shape names preserved in the split files (zero shape deletions). All cross-references updated to point to new file names.
- Remove eager "Study" paragraph that loaded ~135k tokens upfront - Move reference loading into Step 3 where references are actually needed - Add example selection table: agent picks 1-2 most relevant .drawio examples per diagram type (reduces ~95k to ~10-18k tokens) - Update cross-references to renamed files (xml-rules.md, aws4-shapes-services.md) - SKILL.md: 226 lines (under 300 limit)
…s for dark mode - Remove background="#FFFFFF" from mxGraphModel XML template in SKILL.md - Change rule from "ALWAYS set background=#FFFFFF" to "NEVER set background" - Change edge label rule from labelBackgroundColor=#ffffff to labelBackgroundColor=none in layout-guidelines.md and xml-rules.md - Both white backgrounds break dark mode adaptive contrast
- New references/general-icons.md: maps 40+ non-AWS technologies (PostgreSQL, Docker, Kubernetes, CoreML, HuggingFace, GitHub, etc.) to draw.io shapes with category-appropriate tint colors - Mode A codebase analysis now detects non-AWS tech when no AWS infrastructure files are found (Dockerfiles, DB configs, ML frameworks) - Mixed architectures supported: AWS icons for AWS services, general icons for non-AWS, same layout rules for both - Step 3 loads general-icons.md only when non-AWS services are present
PR Review FindingsI reviewed this PR and found 8 issues + 1 additional dark mode bug. All have been addressed in 5 new commits on this branch. Findings Addressed
Additional Fix
New Feature
Commits
|
Keep all new plugins from main (amazon-location-service, aws-amplify, aws-serverless, databases-on-aws, migration-to-aws) and apply our diagram skill additions to deploy-on-aws (description, keywords, tags, version bump to 1.2.0).
| parser.add_argument("--verbose", "-v", action="store_true") | ||
| args = parser.parse_args() | ||
|
|
||
| tree = ET.parse(args.file) |
Check warning
Code scanning / Bandit
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning
| parser.add_argument("--verbose", "-v", action="store_true") | ||
| args = parser.parse_args() | ||
|
|
||
| tree = ET.parse(args.file) |
Check warning
Code scanning / Bandit
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning
| ) | ||
| args = parser.parse_args() | ||
|
|
||
| tree = ET.parse(args.file) |
Check warning
Code scanning / Bandit
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning
| sys.exit(0) | ||
|
|
||
| try: | ||
| tree = ET.parse(file_path) |
Check warning
Code scanning / Bandit
Using xml.etree.ElementTree.parse to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.parse with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning
|
|
||
| # Parse XML | ||
| try: | ||
| root = ET.fromstring(xml_text) |
Check warning
Code scanning / Bandit
Using xml.etree.ElementTree.fromstring to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree.fromstring with its defusedxml equivalent function or make sure defusedxml.defuse_stdlib() is called Warning
| """ | ||
|
|
||
| import argparse | ||
| import xml.etree.ElementTree as ET |
Check notice
Code scanning / Bandit
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Note
| """ | ||
|
|
||
| import argparse | ||
| import xml.etree.ElementTree as ET |
Check notice
Code scanning / Bandit
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Note
| import argparse | ||
| import math | ||
| import re | ||
| import xml.etree.ElementTree as ET |
Check notice
Code scanning / Bandit
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Note
| import argparse | ||
| import json | ||
| import sys | ||
| import xml.etree.ElementTree as ET |
Check notice
Code scanning / Bandit
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Note
| import json | ||
| import re | ||
| import sys | ||
| import xml.etree.ElementTree as ET |
Check notice
Code scanning / Bandit
Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. Note
There was a problem hiding this comment.
Semgrep OSS found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
2 participants
Summary
aws-architecture-diagramskill to thedeploy-on-awsplugin that generates validated AWS architecture diagrams as draw.io XML using official AWS4 icon librariesdeploy-on-awsplugin version from 1.1.0 to 1.2.0 and updates marketplace/plugin manifests with new keywords and descriptionTest plan
claude --plugin-dir ./plugins/deploy-on-awsand trigger the skill by asking to generate an AWS architecture diagram.drawiofile opens correctly in draw.io desktop and renders with proper AWS4 icons, step badges, and category containers.drawiofiles and catches malformed XMLmise run lint:manifeststo validate updated marketplace.json and plugin.jsonmise run lint:cross-refsto validate cross-references between manifestsBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.