Get public holidays by country and year

Query public holidays for any country and year using the apipick Public Holidays API. Supports 100+ countries identified by ISO 3166-1 alpha-2 country codes....

Security Scan

The skill is internally consistent: it only needs an apipick API key and its instructions simply describe making authenticated GET requests to apipick.com to fetch holidays.

Purpose & Capability

Name/description match the required resources and behavior. The only declared secret is APIPICK_API_KEY, which is exactly what's needed to call the apipick Public Holidays API.

Instruction Scope

SKILL.md instructs the agent to use the APIPICK_API_KEY header, convert names to ISO codes if needed, call https://www.apipick.com/api/holidays, and present results. It does not ask to read unrelated files, access other credentials, or contact unexpected endpoints.

Install Mechanism

No install spec and no code files — instruction-only skill. This minimizes disk/execute risk.

Credentials

Only APIPICK_API_KEY is required and declared as the primary credential. That single API key is proportional to the stated task. The SKILL.md uses that env var consistently.

Persistence & Privilege

always is false, no config paths requested, and the skill does not request persistent or elevated platform privileges. Autonomous invocation is enabled by default but not combined with other red flags.

Assessment

This skill is instruction-only and appears to only make authenticated requests to apipick.com using the APIPICK_API_KEY you provide. Before installing: (1) confirm you trust apipick.com and are willing to consume credits (the SKILL.md says 1 credit per request); (2) keep your APIPICK_API_KEY secret — do not paste it into public chat or share it; (3) expect the agent to prompt you for the key if the env var isn't set; (4) if you need stricter control, avoid allowing autonomous agent invocation or restrict when the skill can run. Because there is no packaged code, the main risk is accidental disclosure of your API key or unexpected API usage (billing/credits), not hidden binaries or downloads.

apipick Public Holidays

Query public holidays for 100+ countries by ISO country code and year.

Endpoint

GET https://www.apipick.com/api/holidays

Authentication: x-api-key: YOUR_API_KEY header required. Get a free API key at https://www.apipick.com/dashboard/api-keys

Request Parameters

Parameter	Required	Description
country	Yes	ISO 3166-1 alpha-2 code (e.g. US, GB, CN, DE, JP)
year	No	4-digit year (defaults to current year). Range: 1900 to current year + 10

GET /api/holidays?country=US&year=2026

Response

{
  "success": true,
  "code": 200,
  "message": "Holidays retrieved successfully",
  "data": {
    "country": "US",
    "country_name": "United States",
    "year": 2026,
    "total": 11,
    "holidays": [
      {"date": "2026-01-01", "name": "New Year's Day"},
      {"date": "2026-07-04", "name": "Independence Day"},
      {"date": "2026-12-25", "name": "Christmas Day"}
    ]
  },
  "credits_used": 1,
  "remaining_credits": 99
}

Error Codes

Code	Meaning
400	Invalid country code or year
401	Missing or invalid API key
402	Insufficient credits

Cost: 1 credit per request

Usage Pattern

1. Use $APIPICK_API_KEY env var as the x-api-key header value; if not set, ask the user for their apipick API key
2. Convert a country name to ISO code if the user provides a full name (e.g. "China" → CN, "United Kingdom" → GB)
3. Make the GET request with country and optional year
4. Present the holidays as a sorted list with dates and names

See references/api_reference.md for full response field descriptions.