bamboohr-reference-architecture

Provides a structured reference architecture for integrating BambooHR into production HR data pipelines, enhancing employee data management.

Install this skill

or

0/100

Security score

The bamboohr-reference-architecture skill was audited on May 19, 2026 and we found 38 security issues across 4 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 190

Template literal with variable interpolation in command context

SourceSKILL.md

190	result.errors.push(`Employee ${emp.id}: ${(err as Error).message}`);

medium line 215

Template literal with variable interpolation in command context

SourceSKILL.md

215	'GET', `/employees/changed/?since=${lastSync}`,

medium line 265

Template literal with variable interpolation in command context

SourceSKILL.md

265	orgUnitPath: `/departments/${department}`,

medium line 270

Template literal with variable interpolation in command context

SourceSKILL.md

270	await this.slackClient.addToChannel(workEmail, `#${department.toLowerCase()}`);

medium line 274

Template literal with variable interpolation in command context

SourceSKILL.md

274	text: `Your new report ${firstName} ${lastName} (${jobTitle}) starts soon. ` +

medium line 275

Template literal with variable interpolation in command context

SourceSKILL.md

275	`BambooHR profile: https://${process.env.BAMBOOHR_COMPANY_DOMAIN}.bamboohr.com/employees/employee.php?id=${employeeId}`,

medium line 278

Template literal with variable interpolation in command context

SourceSKILL.md

278	console.log(`Onboarding complete for ${firstName} ${lastName}`);

medium line 291

Template literal with variable interpolation in command context

SourceSKILL.md

291	console.log(`Offboarding complete for ${firstName} ${lastName}`);

medium line 298

Template literal with variable interpolation in command context

SourceSKILL.md

298	await this.googleAdmin.moveUser(workEmail, `/departments/${department}`);

medium line 301

Template literal with variable interpolation in command context

SourceSKILL.md

301	await this.slackClient.addToChannel(workEmail, `#${department.toLowerCase()}`);

medium line 316

Template literal with variable interpolation in command context

SourceSKILL.md

316	console.log(`Full sync: ${result.created} created, ${result.updated} updated, ${result.deleted} deleted`);

medium line 323

Template literal with variable interpolation in command context

SourceSKILL.md

323	console.log(`Incremental sync: ${JSON.stringify(result)}`);

low line 45

Webhook reference - potential data exfiltration

SourceSKILL.md

45	│ API Layer │ Sync Engine │ Webhook Handler │

low line 46

Webhook reference - potential data exfiltration

SourceSKILL.md

46	│ /api/* │ (Cron/Queue) │ /webhooks/bamboohr │

low line 83

Webhook reference - potential data exfiltration

SourceSKILL.md

83	│ │ ├── webhook.ts # Webhook signature verification + routing

low line 100

Webhook reference - potential data exfiltration

SourceSKILL.md

100	│ │ └── webhook.test.ts

low line 143

Webhook reference - potential data exfiltration

SourceSKILL.md

143	sync_type TEXT NOT NULL, -- 'full', 'incremental', 'webhook'

low line 231

Webhook reference - potential data exfiltration

SourceSKILL.md

231	async handleWebhookEvent(employeeId: string, action: string, fields: Record<string, string>) {

low line 319

Webhook reference - potential data exfiltration

SourceSKILL.md

319	// Incremental sync: every 15 minutes (safety net for missed webhooks)

low line 349

Webhook reference - potential data exfiltration

SourceSKILL.md

349	webhook: {

low line 374

Webhook reference - potential data exfiltration

SourceSKILL.md

374	webhook: {

low line 375

Webhook reference - potential data exfiltration

SourceSKILL.md

375	secret: process.env.BAMBOOHR_WEBHOOK_SECRET!,

low line 376

Webhook reference - potential data exfiltration

SourceSKILL.md

376	path: '/webhooks/bamboohr',

medium line 386

Webhook reference - potential data exfiltration

SourceSKILL.md

386	- Employee sync with full, incremental, and webhook-driven modes

medium line 396

Webhook reference - potential data exfiltration

SourceSKILL.md

396	\| Sync data gaps \| Missed webhooks + long incremental interval \| Full sync as daily safety net \|

medium line 397

Webhook reference - potential data exfiltration

SourceSKILL.md

397	\| Duplicate processing \| Webhook retry + no idempotency \| Idempotency keys in sync log \|

medium line 398

Webhook reference - potential data exfiltration

SourceSKILL.md

398	\| Stale local data \| Cache TTL too long \| Webhook-based cache invalidation \|

medium line 407

Webhook reference - potential data exfiltration

SourceSKILL.md

407	- Monitoring: Alert on sync failures, webhook delivery gaps, and API error spikes

medium line 413

Webhook reference - potential data exfiltration

SourceSKILL.md

413	- [BambooHR Webhooks](https://documentation.bamboohr.com/docs/webhooks)

low line 275

Access to .env file

SourceSKILL.md

275	`BambooHR profile: https://${process.env.BAMBOOHR_COMPANY_DOMAIN}.bamboohr.com/employees/employee.php?id=${employeeId}`,

low line 359

Access to .env file

SourceSKILL.md

359	companyDomain: process.env.BAMBOOHR_COMPANY_DOMAIN!,

low line 360

Access to .env file

SourceSKILL.md

360	apiKey: process.env.BAMBOOHR_API_KEY!,

low line 372

Access to .env file

SourceSKILL.md

372	redisUrl: process.env.REDIS_URL,

low line 375

Access to .env file

SourceSKILL.md

375	secret: process.env.BAMBOOHR_WEBHOOK_SECRET!,

low line 275

External URL reference

SourceSKILL.md

275	`BambooHR profile: https://${process.env.BAMBOOHR_COMPANY_DOMAIN}.bamboohr.com/employees/employee.php?id=${employeeId}`,

low line 411

External URL reference

SourceSKILL.md

411	- [BambooHR API Documentation](https://documentation.bamboohr.com/docs)

low line 412

External URL reference

SourceSKILL.md

412	- [BambooHR API Reference](https://documentation.bamboohr.com/reference)

low line 413

External URL reference

SourceSKILL.md

413	- [BambooHR Webhooks](https://documentation.bamboohr.com/docs/webhooks)

Scanned on May 19, 2026

View Security Dashboard

Installation guide →

GitHub Stars 2.2K

Rate this skill

Categoryhr

UpdatedJune 10, 2026

claude-code api backend hr-generalist hr-analyst business-process-analyst hr operations

jeremylongshore/claude-code-plugins-plus-skills