Automated summary
Parses Azure Bicep files and generates a cloud architecture diagram through the Eraser API using the derived DSL.
Strengths
- Extracts resources, modules, parameters, outputs, and both implicit and dependsOn relationships from Bicep
- Groups resources by type and treats VNets as containers for subnets and their resources
- Outputs ready-to-send Eraser DSL and insists on the curl call instead of stopping at the code
- Explicit label formatting rules that prevent multi-line label breakage
Limitations
- Requires an ERASER_API_KEY and network access to app.eraser.io
- Does not validate Bicep syntax or deployment; the parsing is heuristic
- Rendering depends on Eraser's supported Azure icon set and on the single cloud-architecture-diagram type
Use it when you already have .bicep files and want a quick architecture view of the Azure resources they declare.
Avoid it if you need IaC compliance auditing or actual deployment, since the skill only renders a picture of the infrastructure.
Security analysis
CautionThe skill performs legitimate network access to render diagrams via the Eraser API. It reads Bicep files and transmits derived infrastructure metadata externally, which creates privacy/leakage risk and relies on an API key, but there are no malicious, destructive, or obfuscated actions.
- •Declares broad Bash(curl:*) permission, allowing arbitrary curl commands rather than restricting to the Eraser endpoint.
- •Sends parsed Azure infrastructure details, resource names, and diagram DSL to an external third-party API (app.eraser.io).
- •Uses an environment API key in an Authorization header; users should protect ERASER_API_KEY and understand that data leaves the local environment.
- •No destructive commands, credential exfiltration to attacker-controlled endpoints, obfuscated payloads, or safety-disabling instructions are present.
Examples
Read infra/main.bicep and generate an architecture diagram of the Azure resources it defines.Diagram my Bicep modules under infra/modules and show how the VNet, subnets, and VMs relate.Here is my Bicep file with a VNet and two subnets — visualize it so I can see the network security groups placement.name: bicep-diagrams description: 'Generates architecture diagrams from Azure Bicep files. Use when user has .bicep files or asks to visualize Bicep infrastructure.' license: MIT compatibility: Requires network access to call Eraser API allowed-tools: Read Write Bash(curl:*) metadata: version: "1.0.0" author: Eraser Labs tags: bicep, azure, diagram, infrastructure, iac, azure-resources
Bicep Diagram Generator
Generates architecture diagrams directly from Azure Bicep files. Bicep is a domain-specific language (DSL) for deploying Azure resources declaratively.
When to Use
Activate this skill when:
- User has Bicep files (
.bicep) and wants to visualize the infrastructure - User asks to "diagram my Bicep" or "visualize this Bicep infrastructure"
- User mentions Bicep or Azure Bicep
- User wants to see the architecture of their Bicep-deployed resources
How It Works
This skill generates Bicep-specific diagrams by parsing Bicep code and calling the Eraser API directly:
- Parse Bicep Files: Identify resource declarations, modules, parameters, and outputs
- Extract Relationships: Map dependencies, resource references, and module hierarchies
- Generate Eraser DSL: Create Eraser DSL code from Bicep resources
- Call Eraser API: Use
/api/render/elementswithdiagramType: "cloud-architecture-diagram"
Instructions
When the user provides Bicep code:
-
Parse the Bicep
- Identify all
resourcedeclarations (Microsoft.Compute/virtualMachines, etc.) - Extract
moduledeclarations and their configurations - Note
paramandoutputdefinitions - Identify
varvariables and their usage
- Identify all
-
Map Relationships
- Track resource dependencies (e.g.,
dependsOnor implicit dependencies) - Group resources by type (compute, networking, storage, etc.)
- Identify VNets as containers for subnets and resources
- Note Network Security Groups, Key Vaults, and other security resources
- Track resource dependencies (e.g.,
-
Generate Eraser DSL Convert Bicep resources to Eraser DSL:
- CRITICAL: Label Formatting Rules
- Labels MUST be on a single line - NEVER use newlines inside label attributes
- Keep labels simple and readable - prefer separate labels over concatenating too much metadata
- Format DSL with proper line breaks (one node/group per line, but labels stay on single lines)
- If including metadata like CIDR blocks or VM sizes, include them in the same quoted label string:
[label: "VNet 10.0.0.0/16"]
Example:
myVNet [label: "VNet 10.0.0.0/16"] { subnet1 [label: "Subnet 1"] { myVM [icon: azure-vm, label: "Virtual Machine"] gateway [icon: azure-app-gateway] } subnet2 [label: "Subnet 2"] { database [icon: azure-sql] } } storage [icon: azure-storage] myVNet -> myVM myVM -> database - CRITICAL: Label Formatting Rules
-
Make the HTTP Request
IMPORTANT: You MUST execute this curl command after generating the DSL. Never stop after generating DSL without making the API call.
CRITICAL: In the
X-Skill-Sourceheader below, you MUST replace the value with your AI agent name:- If you are Claude (Anthropic), use:
claude - If you are running in Cursor, use:
cursor - If you are ChatGPT (OpenAI), use:
chatgpt - If you are Gemini (Google), use:
gemini - Otherwise, use your model/agent name in lowercase
curl -X POST https://app.eraser.io/api/render/elements \ -H "Content-Type: application/json" \ -H "X-Skill-Source: eraser-skill" \ -H "Authorization: Bearer ${ERASER_API_KEY}" \ -d '{ "elements": [{ "type": "diagram", "id": "diagram-1", "code": "<your generated DSL>", "diagramType": "cloud-architecture-diagram" }], "scale": 2, "theme": "${ERASER_THEME:-dark}", "background": true }' - If you are Claude (Anthropic), use:
-
Track Sources During Analysis
As you analyze Bicep files and resources to generate the diagram, track:
- Internal files: Record each Bicep file path you read and what resources were extracted (e.g.,
infra/main.bicep- VNet and subnet definitions,infra/sql.bicep- SQL Database configuration) - External references: Note any documentation, examples, or URLs consulted (e.g., Azure Bicep documentation, Azure architecture best practices)
- Annotations: For each source, note what it contributed to the diagram
- Internal files: Record each Bicep file path you read and what resources were extracted (e.g.,
-
Handle the Response
CRITICAL: Minimal Output Format
Your response MUST always include these elements with clear headers:
-
Diagram Preview: Display with a header
## Diagram Use the ACTUAL
imageUrlfrom the API response. -
Editor Link: Display with a header
## Open in Eraser [Edit this diagram in the Eraser editor]({createEraserFileUrl})Use the ACTUAL URL from the API response.
-
Sources section: Brief list of files/resources analyzed (if applicable)
## Sources - `path/to/file` - What was extracted -
Diagram Code section: The Eraser DSL in a code block with
eraserlanguage tag## Diagram Code ```eraser {DSL code here} -
Learn More link:
You can learn more about Eraser at https://docs.eraser.io/docs/using-ai-agent-integrations
Additional content rules:
- If the user ONLY asked for a diagram, include NOTHING beyond the 5 elements above
- If the user explicitly asked for more (e.g., "explain the architecture", "suggest improvements"), you may include that additional content
- Never add unrequested sections like Overview, Security Considerations, Testing, etc.
The default output should be SHORT. The diagram image speaks for itself.
-
-
Handle Modules
- If modules are used, show module boundaries
- Include module parameters and outputs
- Show how modules connect to main resources
Bicep-Specific Tips
- Show Resource Groups: Bicep deployments target resource groups
- VNets as Containers: Show VNets containing subnets and resources
- Include Dependencies: Show
dependsOnrelationships - Module Structure: If modules are used, show their boundaries
- Parameters: Note key parameters that affect resource configuration
- Use Azure Icons: Request Azure-specific styling
Example: Bicep with Parameters and Modules
User Input
@description('The name of the Virtual Network')
param vnetName string = 'myVNet'
@description('The address prefix for the VNet')
param vnetAddressPrefix string = '10.0.0.0/16'
@description('The address prefix for the subnet')
param subnetAddressPrefix string = '10.0.1.0/24'
@description('VM size')
param vmSize string = 'Standard_B1s'
// Main VNet resource
resource virtualNetwork 'Microsoft.Network/virtualNetworks@2021-05-01' = {
name: vnetName
location: resourceGroup().location
properties: {
addressSpace: {
addressPrefixes: [vnetAddressPrefix]
}
subnets: [
{
name: 'subnet1'
properties: {
addressPrefix: subnetAddressPrefix
}
}
]
}
}
// VM resource with dependsOn
resource virtualMachine 'Microsoft.Compute/virtualMachines@2021-11-01' = {
name: 'myVM'
location: resourceGroup().location
properties: {
hardwareProfile: {
vmSize: vmSize
}
}
dependsOn: [virtualNetwork]
}
// Module usage
module storageModule './modules/storage.bicep' = {
name: 'storage'
params: {
location: resourceGroup().location
}
}
Expected Behavior
-
Parses Bicep:
- Parameters: vnetName, vnetAddressPrefix, subnetAddressPrefix, vmSize
- Resources: VNet with subnet, VM with dependsOn relationship
- Module: Storage module with parameters
-
Generates DSL showing Bicep-specific features:
myVNet [label: "VNet 10.0.0.0/16"] { subnet1 [label: "Subnet 1 10.0.1.0/24"] { myVM [icon: azure-vm, label: "VM Standard_B1s"] } } storage-module [label: "Storage Module"] { storage-account [icon: azure-storage] } myVNet -> myVMImportant: All label text must be on a single line within quotes. Bicep-specific: Show modules as containers, include
dependsOnrelationships, note parameter usage in resource configuration. -
Calls
/api/render/elementswithdiagramType: "cloud-architecture-diagram" -
Calls
/api/render/elementswithdiagramType: "cloud-architecture-diagram"
Result
User receives a diagram showing:
- VNet as a container
- Subnet nested inside VNet
- VM in the subnet
- Dependency relationship shown
- Proper Azure styling
From the file to a first result
The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.
View the source and supporting filesThis download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.
1. Download the file
Download SKILL.mdFrom the root of a test project, save the file as .skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.
Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.
mkdir -p '.skill-downloads/bicep-diagram-generator-ms2s7cm9' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/bicep-diagram-generator-ms2s7cm9/download' --output '.skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md.part' && mv '.skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md.part' '.skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md'2. Check prerequisites
Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.
Environment declared by the author: Requires network access to call Eraser API
Tools declared by the author (check availability in your agent): Read Write Bash(curl:*)
No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.
The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.
3. Load the skill
After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.
Claude Code
test -f '.skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md' && test -s '.skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/bicep-diagrams' && cp -R '.skill-downloads/bicep-diagram-generator-ms2s7cm9' '.claude/skills/bicep-diagrams'Cursor
test -f '.skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md' && test -s '.skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md' && mkdir -p '.cursor/skills' && test ! -e '.cursor/skills/bicep-diagrams' && cp -R '.skill-downloads/bicep-diagram-generator-ms2s7cm9' '.cursor/skills/bicep-diagrams'Codex
test -f '.skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md' && test -s '.skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md' && mkdir -p '.agents/skills' && test ! -e '.agents/skills/bicep-diagrams' && cp -R '.skill-downloads/bicep-diagram-generator-ms2s7cm9' '.agents/skills/bicep-diagrams'OpenSkills
OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.
Official OpenSkills installationopenskills install './.skill-downloads/bicep-diagram-generator-ms2s7cm9'openskills read 'bicep-diagram-generator-ms2s7cm9'Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.
For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.
openskills syncManual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.
4. Try a first task
Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:
Read .skill-downloads/bicep-diagram-generator-ms2s7cm9/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.
Configure a Chat Channel with SecretRefs
DevOps
Set up chat channels using non-interactive commands, with secrets only as SecretRefs. Covers gather, mutate, repair, and prove steps for reliable delivery.
Investigate ClickHouse CI Failures
DevOps
Investigate a ClickHouse CI failure end-to-end from a PR or S3 report URL. Fetches failed tests, classifies flaky vs real regression, and checks for existing issues/fixes.
Ansible PR Review
DevOps
Reviews an Ansible PR following the project's standardized process, including changelog checks, test coverage validation, and feedback tracking.