Is this mixing routine secure ? As part of a school project we are asked to create a mixing service. Most of the services right now use coinjoin implemented with more or less privacy. 

So a single mixing service wouldn't be enough so here is the mixing routine we thought of :

bitcoin(in) -> mix -> shapeshift( -> Zcash -> monero) -> xmr.to ( btc) -> mix -> joinmarket (not sure though we haven't dug a lot into it) -> bitcoin (out)

Of course everything would be automated via various api offered by the services.

Do you have any remarks about it ? Is it good/bad ? 

We are kind of afraid about the fees induced by so many external services but implementing our own mixer would require a user base to mix the coin with in the first place which we don't have.
This mixing service seems solid overall.

You could improve it in several ways:


Don't shapeshift your mixed BTC into Zcash. Shapeshift uses "transparent addresses" - which means the Zcash transaction is exactly as transparent as a regular bitcoin transaction. This is because Zcash requires upwards of 8GB of ram and approximately a minute of processing time to generate the private transaction - which Shapeshift is obviously unwilling to commit to for every transaction.
Why mix your bitcoin received via xmr.to before mixing it with joinmarket? One additional mix (using joinmarket) should be enough to obfuscate xmr.to's snooping should they attempt to track the Bitcoin that was exchanged for your Monero  (although there are questions about the long-term viability of bitcoin mixers in general). 


You could also argue that the initial mix before you hit shapeshift is unnecessary  if you do not care that Shapeshift knows how you obtained the Bitcoin that you are trading them for Monero. 

Best of luck with your school project!