Pipeworx bamboohr

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:58 AM UTC
• Version: 1.0.0

Overview

This BambooHR skill should be reviewed carefully because it routes sensitive employee data through a third-party MCP gateway without explaining authorization, privacy, or data-handling controls.

Install only after verifying who operates the Pipeworx gateway, how BambooHR credentials and employee data are handled, and whether your organization has approved this processor. Use narrowly scoped, revocable BambooHR access and avoid using the skill for employee files or time-off data unless that workflow is explicitly authorized.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:27

Finding

Unverified Third-Party MCP Gateway Handles Sensitive BambooHR Operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–31
Vulnerability Type: Third-party service and supply-chain trust risk
Risk Level: High

json

{
  "mcpServers": {
    "bamboohr": {
      "url": "https://gateway.pipeworx.io/bamboohr/mcp"
    }
  }
}

Technical Analysis

The skill configures gateway.pipeworx.io, an external MCP gateway, to broker BambooHR operations instead of directly using a BambooHR-owned endpoint or a locally auditable connector. The documented operations provide access to employee directory information, detailed employee records, time-off requests, and employee-file metadata.

The repository contains no connector implementation, integrity control, ownership verification, privacy documentation, or explanation of how BambooHR credentials and returned HR data are handled by this intermediary. Consequently, the gateway is a supply-chain trust boundary whose behavior cannot be validated from the reviewed project.

A compromised or malicious gateway could inspect requests and returned HR information, manipulate MCP responses, collect authentication material if it is transmitted or delegated to the service, or change its server-side behavior after this static skill configuration has been reviewed.

Attack Path

1. A user installs or enables the skill and its supplied MCP configuration.
2. The agent connects to https://gateway.pipeworx.io/bamboohr/mcp.
3. The user or agent authorizes BambooHR access and invokes a documented operation, such as employee-detail, directory, time-off, or file-metadata retrieval.
4. Requests and sensitive results are processed through the third-party gateway.
5. If the gateway is malicious or compromised, it can retain exposed HR data, misuse any credentials or authorization tokens made available to it, and return altered or deceptive tool responses.
6. Subsequent agent decisions may rely on manipulated HR records or other gateway-controlled output.

Impact Assessment

The ...[truncated 749 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the third-party gateway with an official BambooHR endpoint or a locally hosted, source-audited MCP connector.
2. If the gateway is required, verify its operator, security posture, contractual data-processing terms, retention practices, incident-response process, and BambooHR authorization model before deployment.
3. Use narrowly scoped, revocable credentials dedicated to this integration. Do not provide administrative or unrelated BambooHR permissions.
4. Require explicit administrator approval and informed user consent before transmitting workforce data through the gateway.
5. Restrict available operations and returned fields to the minimum required for each workflow, particularly for leave data and employee-file information.
6. Prevent the intermediary from receiving reusable credentials where possible. Prefer short-lived tokens, delegated authorization, rotation, and immediate revocation capability.
7. Add outbound network allowlisting, gateway identity validation, audit logging, access monitoring, and alerts for unusual employee-record queries.
8. Document the gateway as an external trust boundary and define retention, deletion, breach-notification, and employee-privacy controls.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises access to highly sensitive HR data including employee directory details, detailed employee records, time-off requests, and employee file listings, but provides no privacy, authorization, or data-handling constraints. In an agent context, this can normalize broad retrieval of PII and HR-sensitive information, increasing the chance of over-collection, insider misuse, or disclosure through prompts, logs, and downstream tooling.

Content

No source excerpt is available for this finding.