plan-canvas
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
ecc-plan-canvasCLI utility (part of theecc-universalpackage) to manage the review lifecycle, including opening artifacts and awaiting user feedback. - [EXTERNAL_DOWNLOADS]: When rendering diagrams, the browser canvas fetches the Mermaid.js library from a public CDN. The skill provides an environment variable (
ECC_PLAN_CANVAS_MERMAID_URL) to use a local mirror if required. - [DATA_EXFILTRATION]: The system uses a local-only loopback server on port 4517 for communication between the CLI tool and the browser. No sensitive data is transmitted to external servers, and the server is restricted to 127.0.0.1.
Audit Metadata