Orthogonal API Platform - Access paid APIs using the SDK, Run API, or x402 direct payment. Search, discover, and integrate APIs with simple tool calls.

Orthogonal API Platform - Access 100+ premium APIs using the SDK, Run API, or x402 direct payment. Search, discover, and integrate APIs with simple tool calls.

This skill appears to be a coherent API marketplace client, but the published metadata does NOT declare the environment variables the instructions require. Before enabling or using it: - Confirm required credentials: the SKILL.md requires ORTHOGONAL_API_KEY and (optionally) a PRIVATE_KEY for direct x402 payments. Ask the publisher to update the manifest to declare these explicitly. - Treat PRIVATE_KEY as highly sensitive: avoid storing long-term private keys in plaintext env vars on shared systems. Prefer ephemeral keys/accounts, restricted wallets with minimal funds, or using a signing service/connector rather than exporting raw private keys into the environment. - Verify the SDK/package: if you plan to npm install @orth/sdk or x402 client libs, verify the package name, author, and integrity (checksums, repository, and official docs) before installing. - Confirm billing implications: the run endpoint charges credits/USDC; make sure you understand pricing and limits and monitor for unexpected charges. - If you need least privilege: create a dedicated API key with limited scope and a separate low-value blockchain account for payments. If the publisher cannot justify the missing env declarations or cannot provide guidance for safe key handling, treat installation as higher risk and consider not enabling the skill.

Type: OpenClaw Skill Name: orthogonal Version: 1.0.0 The skill bundle defines an API client for the Orthogonal platform. All network calls are explicitly directed to `https://api.orth.sh/v1` or `https://x402.orth.sh`. It uses environment variables for `ORTHOGONAL_API_KEY` and `PRIVATE_KEY`, which is standard practice and there are no instructions to exfiltrate these or any other sensitive data. The `skill.md` contains no prompt injection attempts, malicious execution commands (e.g., `curl|bash`), or persistence mechanisms. The content is clearly aligned with its stated purpose of interacting with the Orthogonal API.