Agent skill · security · jeremylongshore
bamboohr-security-basics
Threat-model and harden a BambooHR integration that handles employee PII, OAuth tokens, API keys, files, and webhooks. Use when reviewing access, storage, logging, or incident controls. Trigger with "secure BambooHR", "BambooHR PII", "BambooHR threat model", or "BambooHR secrets".
Why this skill is useful
Provides specific procedures and code snippets for securing BambooHR API keys and handling sensitive employee data that the AI wouldn't reliably generate on its own.
What it needs
Requires bamboohr account access. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
BambooHR Integration Security Overview Treat the connector as a high-sensitivity HR data system. Security is not only secret storage: it includes tenant isolation, field-level authorization, data minimization, webhook authenticity, auditability, and deletion. Prerequisites The target repository or integration path and the requested operator outcome. The tenant, identity, and data scope only when approved live work is in scope. The current evidence register plus customer-specific permissions and agreements. Current Contract BambooHR permissions affect which employee fields and operations an identity can access. The official SDK supports secure logging and request-ID extraction, but application logs, queues, databases, exports, and support artifacts remain the operator's responsibility. Webhook creation returns a one-time private key. Authentication Use OAuth for partner integrations with validated state, exact HTTPS redirect URIs, encrypted per-subject token storage, and persisted token rotation. For API keys, use a dedicated least-privilege user, named owner, expiry review, and tested revocation. Never share one identity across tenants. Instructions 1. Map trust boundaries: user/browser, callback, token store, connector, BambooHR tenant, queue, destination, logs, backups, support, and analytics. 2. Inventory every requested field and classify sensitivity. Remove fields not tied to an approved purpose; isolate government IDs, compensation, medical, dependent, benefit, and file data. 3. Enforce tenant from trusted credential metadata, not from a request body. Validate identifiers at every queue and storage boundary. 4. Redact authorization, keys, cookies, query strings, webhook secrets, and HR values. Allow request IDs, operation names, status, latency, and safe counts. 5. For webhooks, store the creation-only key atomically, verify HMAC-SHA256 over raw bytes using the currently documented carrier, compare in constant time, and reject before parsing or side effects. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/bamboohr-security-basics