HuDy

• Risk level: Low
• Analyzed: Feb 24, 2026, 3:12 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requests and runtime instructions are coherent with its stated purpose (Korean holiday and business-day APIs) and only require a single API key; nothing in the SKILL.md attempts to access unrelated secrets, files, or system resources.

This skill appears coherent: it only needs your HUDY_API_KEY to call HuDy's MCP endpoint. Before installing, verify hudy.co.kr is the legitimate service you expect, keep the API key private, and consider using a key with limited scope or easy rotation. If you plan to use calendar sync (iCal) or share calendar URLs, be aware those URLs may expose event data to whoever has the link. Monitor API usage for unexpected calls after enabling the skill.