figma-generate-personal-token
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: Executes a local Python script (
manage-token.py) to handle token logic and utilizes standard shell utilities likegrep,cut, andpbpasteto parse output and interact with the system clipboard.\n- [CREDENTIALS_UNSAFE]: ReadsFIGMA_PASSWORDandFIGMA_TOKENfrom local environment files. The automation script outputs the password in plaintext to the console during the auto-login phase specifically to enable the agent to populate the login form in the browser.\n- [DATA_EXFILTRATION]: Conducts network requests to official Figma domains (api.figma.comandfigma.com) to authenticate the user and validate token status. This involves reading credentials from local files and submitting them to the official service's login endpoint.
Audit Metadata