bamboohr-hello-world
Provides a minimal working example for integrating with BambooHR API to fetch employee data and run reports.
Install this skill
Security score
The bamboohr-hello-world skill was audited on May 19, 2026 and we found 22 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 39 | const BASE = `https://api.bamboohr.com/api/gateway.php/${COMPANY}/v1`; |
Template literal with variable interpolation in command context
| 40 | const AUTH = `Basic ${Buffer.from(`${API_KEY}:x`).toString('base64')}`; |
Template literal with variable interpolation in command context
| 43 | const dirRes = await fetch(`${BASE}/employees/directory`, { |
Template literal with variable interpolation in command context
| 48 | console.log(`Company has ${directory.employees.length} employees`); |
Template literal with variable interpolation in command context
| 50 | console.log(` ${emp.displayName} — ${emp.jobTitle} (${emp.department})`); |
Template literal with variable interpolation in command context
| 83 | `${BASE}/employees/123/?fields=firstName,lastName,jobTitle,department,hireDate,workEmail,status`, |
Template literal with variable interpolation in command context
| 88 | console.log(`${employee.firstName} ${employee.lastName}`); |
Template literal with variable interpolation in command context
| 89 | console.log(` Title: ${employee.jobTitle}`); |
Template literal with variable interpolation in command context
| 90 | console.log(` Dept: ${employee.department}`); |
Template literal with variable interpolation in command context
| 91 | console.log(` Hired: ${employee.hireDate}`); |
Template literal with variable interpolation in command context
| 92 | console.log(` Email: ${employee.workEmail}`); |
Template literal with variable interpolation in command context
| 111 | const reportRes = await fetch(`${BASE}/reports/custom?format=JSON`, { |
Template literal with variable interpolation in command context
| 128 | console.log(`Report: ${report.title} — ${report.employees.length} rows`); |
Template literal with variable interpolation in command context
| 130 | console.log(` ${row.firstName} ${row.lastName} | ${row.department}`); |
Access to .env file
| 37 | const COMPANY = process.env.BAMBOOHR_COMPANY_DOMAIN!; |
Access to .env file
| 38 | const API_KEY = process.env.BAMBOOHR_API_KEY!; |
Unicode escape sequences
| 3 | description: "Create a minimal working BambooHR example \u2014 fetch employee directory\ |
External URL reference
| 39 | const BASE = `https://api.bamboohr.com/api/gateway.php/${COMPANY}/v1`; |
External URL reference
| 72 | "photoUrl": "https://..." |
External URL reference
| 143 | BASE = f"https://api.bamboohr.com/api/gateway.php/{COMPANY}/v1" |
External URL reference
| 179 | - [BambooHR Field Names Reference](https://documentation.bamboohr.com/docs/list-of-field-names) |
External URL reference
| 180 | - [BambooHR API Technical Overview](https://documentation.bamboohr.com/docs/api-details) |