← Back to Skills Marketplace
Pipeworx bamboohr
by
Bruce Gutman
· GitHub ↗
· v1.0.0
· MIT-0
86
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install pipeworx-bamboohr
Description
Access and manage BambooHR employee data, including directory, individual profiles, time-off requests, and employee files via API.
Usage Guidance
This skill wants to read and manage sensitive HR records but does not declare how it authenticates and points the agent at an external gateway (gateway.pipeworx.io). Before installing: 1) Ask the publisher to prove ownership/trustworthiness of gateway.pipeworx.io and provide privacy/security documentation (who hosts it, where data is stored, retention, logging, access controls, SOC/ISO reports). 2) Require the skill to declare where credentials belong (do you need a BambooHR API key? will credentials be stored on the gateway?), and prefer a version that calls api.bamboohr.com directly or documents a vetted connector. 3) Do not enable this skill for production HR data until you confirm the gateway’s security and obtain an explicit data-flow and auth model. If you cannot verify these things, consider the risk that employee data could be routed to or retained by an untrusted third party.
Capability Analysis
Type: OpenClaw Skill
Name: pipeworx-bamboohr
Version: 1.0.0
The skill bundle provides a standard integration for BambooHR via an MCP server hosted at gateway.pipeworx.io. It defines functions for managing employee data, time-off requests, and files in SKILL.md. No malicious code, obfuscation, or prompt injection attempts were found.
Capability Assessment
Purpose & Capability
The skill's stated purpose is to access and manage BambooHR employee data. However, it declares no required environment variables, no primary credential, and no config paths for BambooHR API keys — yet the SKILL.md contains an mcpServers entry pointing to https://gateway.pipeworx.io/bamboohr/mcp. Either the gateway will handle authentication (not documented) or the skill is missing required credentials. This mismatch (sensitive HR access without declared auth) is unexpected.
Instruction Scope
Instructions are brief and only list available operations, but the included mcpServers config directs the agent to an external, third-party gateway (pipeworx). The SKILL.md does not describe how authentication, logging, or data handling occur, nor does it limit where retrieved employee data may be sent. Because the agent would call a non-BambooHR endpoint to retrieve HR records, the instruction scope potentially routes sensitive data to an external service without disclosure.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. Nothing will be written to disk by an installer, which is the lowest-risk install mechanism.
Credentials
For a skill that accesses HR data, one expects explicit credentials (BambooHR API key or OAuth token) or at least documentation of where credentials are stored. The skill requests no env vars and no primary credential, which is disproportionate and ambiguous — it implies reliance on the external gateway for auth without documenting it.
Persistence & Privilege
always is false and the skill does not request elevated or persistent system privileges. Autonomous invocation is allowed by default (disable-model-invocation: false), which is normal, but combined with the other concerns increases potential impact if the gateway is untrusted.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install pipeworx-bamboohr - After installation, invoke the skill by name or use
/pipeworx-bamboohr - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release
Metadata
Frequently Asked Questions
What is Pipeworx bamboohr?
Access and manage BambooHR employee data, including directory, individual profiles, time-off requests, and employee files via API. It is an AI Agent Skill for Claude Code / OpenClaw, with 86 downloads so far.
How do I install Pipeworx bamboohr?
Run "/install pipeworx-bamboohr" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Pipeworx bamboohr free?
Yes, Pipeworx bamboohr is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Pipeworx bamboohr support?
Pipeworx bamboohr is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Pipeworx bamboohr?
It is built and maintained by Bruce Gutman (@b-gutman); the current version is v1.0.0.
More Skills