diff --git a/.claude/skills/mermaid-diagram/SKILL.md b/.claude/skills/mermaid-diagram/SKILL.md
new file mode 100644
index 0000000..48501ea
--- /dev/null
+++ b/.claude/skills/mermaid-diagram/SKILL.md
@@ -0,0 +1,172 @@
+---
+name: mermaid-diagram
+description: Create, edit, and regenerate Mermaid architecture diagrams for the README and website. Use when the user asks to create, update, or regenerate diagrams.
+allowed-tools: Bash(mise:*), Bash(mmdc:*), Read, Write, Edit, Glob
+---
+
+# Mermaid Diagrams
+
+Architecture diagrams are authored as Mermaid `.mmd` files and pre-rendered to SVGs for the static website. The README uses inline mermaid code blocks (rendered natively by GitHub).
+
+## Source files
+
+| File | Purpose |
+|------|---------|
+| `web/arch-explicit.mmd` | Explicit proxy mode diagram |
+| `web/arch-transparent.mmd` | Transparent proxy mode diagram |
+| `web/arch-dns.mmd` | DNS resolver mode diagram |
+| `web/mermaid-config.json` | Custom theme matching the website palette |
+
+The `.mmd` files are the **source of truth**. The `.svg` files are generated artifacts. The README contains the same mermaid syntax inline as fenced code blocks.
+
+When updating a diagram, update **both** the `.mmd` file and the corresponding mermaid code block in `README.md`.
+
+## Tool setup
+
+The mermaid CLI (`mmdc`) is installed via mise:
+
+```toml
+# mise.toml
+"npm:@mermaid-js/mermaid-cli" = "latest"
+```
+
+Ensure it's installed:
+
+```bash
+mise install
+```
+
+## Generating SVGs
+
+Generate a single diagram:
+
+```bash
+mise exec -- mmdc \
+ -i web/arch-explicit.mmd \
+ -o web/arch-explicit.svg \
+ -c web/mermaid-config.json \
+ -b transparent
+```
+
+Generate all three:
+
+```bash
+for mode in explicit transparent dns; do
+ mise exec -- mmdc \
+ -i "web/arch-${mode}.mmd" \
+ -o "web/arch-${mode}.svg" \
+ -c web/mermaid-config.json \
+ -b transparent
+done
+```
+
+## Previewing
+
+To visually inspect a diagram, render to PNG in `tmp/`:
+
+```bash
+mise exec -- mmdc \
+ -i web/arch-explicit.mmd \
+ -o tmp/arch-explicit.png \
+ -c web/mermaid-config.json \
+ -b transparent
+```
+
+Then use the Read tool on the PNG to see the result.
+
+## Custom theme
+
+The file `web/mermaid-config.json` defines a custom Mermaid theme that matches the website's color palette:
+
+| Theme variable | Value | Maps to site variable |
+|---------------|-------|----------------------|
+| `primaryColor` | `#12121a` | `--bg-card` |
+| `primaryBorderColor` | `#00ff41` | `--green` / `--accent` |
+| `primaryTextColor` | `#c8c8d0` | `--text` |
+| `lineColor` | `#00e5ff` | `--cyan` |
+| `clusterBkg` | `rgba(0,255,65,0.06)` | `--accent-glow` |
+| `clusterBorder` | `rgba(0,255,65,0.3)` | green with transparency |
+| `background` | `transparent` | sits on site's `--bg` |
+| `fontFamily` | `monospace` | `--font-mono` |
+
+If the website palette changes, update `mermaid-config.json` to match.
+
+## Mermaid syntax quick reference
+
+The diagrams use `graph LR` (left-to-right flowchart):
+
+```mermaid
+graph LR
+ A["Node A"] --> B["Node B"]
+ B -->|"label"| C["Node C"]
+
+ subgraph S["Group label"]
+ D["Inside node"]
+ end
+
+ A --> S
+ S --> C
+```
+
+Key syntax:
+- `graph LR` — left to right. Use `graph TD` for top to bottom.
+- `A["Label"]` — node with label
+- `A --> B` — arrow from A to B
+- `A -->|"text"| B` — arrow with label
+- `subgraph name["Label"] ... end` — group nodes in a box
+- `
` — line break in labels
+
+Full syntax reference: https://mermaid.js.org/syntax/flowchart.html
+
+## Website integration
+
+The generated SVGs are referenced in `web/index.html` as `` tags inside `.arch-mode-card` divs:
+
+```html
+
Description text.
+Caption text.
+A man-in-the-middle proxy that intercepts, inspects, and modifies HTTP/HTTPS traffic before it reaches your browser.
+Full MITM proxy for browsers, transparent interception for managed networks, or DNS-level blocking for everything else.
Desktops and laptops connect over HTTPS on port 8443 via PAC file or manual proxy settings. Mobile devices connect over HTTP on port 8080. Devices that can't install a CA cert (smart TVs, game consoles, IoT) use the built-in DNS resolver on port 53 for host-level blocking. The proxy generates per-host TLS certificates on the fly using its own CA.
-Blocked resource elements (<script>, <iframe>) are stripped from HTML. CSS element-hiding rules are pre-filtered from ~64K global selectors down to <200 per page. Scriptlets are injected to neutralize anti-adblock scripts. Blocked requests can be replaced with neutered placeholders via $redirect.