Get public holidays by country and year

• Risk level: Low
• Analyzed: May 1, 2026, 5:56 AM
• Findings: 1
• Version: 1.0.0

Overview

This is a straightforward public-holiday lookup skill that uses a documented Apipick API key and does not include install scripts or executable code.

This appears safe to install if you are comfortable letting the agent call Apipick for holiday lookups. Keep the API key scoped to Apipick, store it as an environment variable, and remember each successful lookup costs one API credit.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

The agent may use the user's Apipick API key and spend API credits when answering holiday queries.

Why it was flagged

The skill needs a third-party API credential and each successful request consumes account credits, but this is disclosed and directly aligned with the holiday lookup purpose.

Skill content

Use `$APIPICK_API_KEY` env var as the `x-api-key` header value; if not set, ask the user for their apipick API key ... Cost: 1 credit per request

Recommendation

Store the key in APIPICK_API_KEY rather than pasting it into prompts when possible, monitor usage, and rotate the key if it is exposed.