Bebebebebe

Set up Orthogonal for your AI agent - access premium APIs and skills

Security Scan

The instructions broadly match a tool to enable a third‑party marketplace (Orthogonal), but the skill omits declarations and asks the agent to install/run software and store API/OAuth credentials and to pull/install arbitrary skills—behaviors that increase risk and merit scrutiny before installing.

Purpose & Capability

The name/description (set up Orthogonal to access premium APIs/skills) aligns with the instructions: installing a CLI, authenticating, and adding marketplace skills. However the skill's manifest claims no required env vars/config paths while the runtime instructions explicitly require an API key, a credentials file (~/.config/orthogonal/credentials.json) or ORTHOGONAL_API_KEY and tell the user to install a global npm package. That mismatch (declared requirements = none vs instructions that require credentials and installing software) is a coherence issue.

Instruction Scope

The SKILL.md tells the agent to: install a global npm CLI, write/read ~/.config/orthogonal/credentials.json, search and install skills into the agent's skills directory, and run remote APIs (including OAuth integrations for Gmail/Slack/Drive). These steps involve creating credentials, modifying agent skill files, and calling external services—all of which go beyond a passive helper and could lead to credential use or data exfiltration if the marketplace or installed skills are untrusted.

Install Mechanism

There is no formal install spec in the registry, but the instructions tell the user to run 'npm install -g @orth/cli'. Installing a global npm package (and then using it to download/install marketplace skills) is a moderate-to-high risk path because it executes third-party code and will place files on disk. The skill does not provide checksums, pinned versions, or a vetted install source beyond the package name and site URL.

Credentials

Although the registry lists no required env vars/credentials, the instructions require an Orthogonal API key (stored in a credentials file or ORTHOGONAL_API_KEY) and describe connecting OAuth accounts (Gmail, Slack, Google Drive, etc.). Requesting those credentials is reasonable for a marketplace integrator, but the omission from the manifest is problematic and the scope of credentials (access to many account types) is broad — granting them gives significant access to user data and actions.

Persistence & Privilege

always:false and normal autonomous invocation are set (no elevated registry privilege). However the instructions explicitly install skills into the agent's skills directory and write local credentials, which creates persistent changes and expands the agent's capabilities. Combine that with installing third‑party code and OAuth tokens, and the skill effectively increases the agent's long‑term privileges — this is expected for a marketplace integrator but worth flagging.

What to consider before installing

This skill is a how‑to for installing and using a third‑party marketplace (Orthogonal). Before proceeding: (1) Confirm you trust orthogonal.com and the npm package @orth/cli — inspect the package source and releases, and prefer pinned versions. (2) Understand that you will be asked to store an API key (credentials file or ORTHOGONAL_API_KEY) and may connect OAuth accounts (Gmail/Slack/Drive), which grants the marketplace and installed skills access to your data and ability to act on your behalf. (3) Be cautious about 'installing skills' into your agent's skills directory: those are executable code files from remote authors—review them before enabling. (4) If possible, run the CLI and any installed skills in a sandbox or isolated environment, and avoid granting OAuth tokens or API keys unless you accept the risk. (5) Ask the maintainer to update the registry metadata to declare required env vars and config paths and to provide install checksums or source links; absence of those declarations is a red flag.

Orthogonal for AI Agents

Orthogonal gives your AI agent access to premium APIs and curated skills. Works with any agent framework (OpenClaw, Claude Code, Cursor, etc.). This guide helps you set everything up.

Decision Flow: Skills First, Then API Search

When a user asks you to perform a task (e.g. "enrich Sundar Pichai", "find the email for the CEO of Anthropic", "extract brand assets from apple.com"):

1. Check installed skills first — Look through your available skills for one that handles the task. Skills are curated workflows with tested parameters and better results (e.g. enrich, find-email-by-name, get-brand-assets).
2. Search for skills — If no installed skill matches, use orth skills search "<task>" to find one you can install. Do this even if an installed skill seems "close enough." A general-purpose skill (e.g. enrich) should not be stretched to cover tasks that have dedicated skills (e.g. team-linkedin-profiles for finding an entire team's profiles). Always search before repurposing a general skill.
3. Fall back to API search — Only if no skill covers the use case, use orth api search "<task>" to find a raw API endpoint.
4. Check parameters before calling — Before calling any API endpoint or integration action for the first time, run orth api show <slug> <path> to see its parameter names, types, and required fields. Do not guess parameter names — integration actions especially have non-obvious names (e.g. first_cell_location not range).

Why skills first? Skills wrap APIs with correct parameters, error handling, and optimized workflows. Raw API search requires you to figure out params from scratch, which is slower and more error-prone.

Quick Start

1. Install the CLI

npm install -g @orth/cli

2. Authenticate

orth login

This prompts for your API key and stores it locally. Get your key at https://orthogonal.com/dashboard/settings

3. Add Core Skills

Install the essential skills for discovering and using Orthogonal:

# Find and install skills from the Orthogonal library
orth skills add orthogonal/find-skill

# Find and call APIs from the Orthogonal marketplace
orth skills add orthogonal/find-api

Skills are installed to your agent's skills directory (e.g. ~/.openclaw/skills/, ~/.claude/skills/, or wherever your agent reads skill files).

---

CLI Commands

Skills Commands

# List all available skills
orth skills

# Search for skills
orth skills search "weather"

# Add a skill (use full slug with namespace)
orth skills add <owner/slug>

# View skill details
orth skills info <slug>

API Commands

# List all available APIs
orth api

# Search for APIs
orth api search "scrape websites"

# Get API details
orth api info <api-slug>

# Show endpoint/action parameters (names, types, required fields)
orth api show <api-slug> <path>

# Call an API directly
orth run <api-slug> <path> [options]

Running APIs

# Basic usage
orth run olostep /v1/scrapes -b '{"url_to_scrape": "https://example.com"}'

# With query parameters
orth run searchapi /api/v1/search -q 'engine=google&q=AI agents'

# See what an API call would cost (dry run)
orth run --dry-run olostep /v1/scrapes -b '{"url_to_scrape": "https://example.com"}'

---

Core Skills

find-skill

Discover and install skills from the Orthogonal skill library.

Use when:

• You need capabilities you don't have
• You want to discover available skills
• You need to add new tools to your agent

Example prompts:

• "Find a skill for sending text messages"
• "What skills are available for weather?"
• "Install the restaurant booking skill"

find-api

Find and call APIs from the Orthogonal API marketplace.

Use when:

• You need external data (weather, search, scraping, etc.)
• You want to discover available APIs
• You need to integrate third-party services

Example prompts:

• "Find an API for web scraping"
• "Search for email verification APIs"
• "Call the Tomba API to find someone's email"

---

Authentication

Your API key is stored at ~/.config/orthogonal/credentials.json after running orth login.

Manual setup (if needed):

1. Get your API key at https://orthogonal.com/dashboard/settings
2. Create the credentials file:

mkdir -p ~/.config/orthogonal
echo '{"apiKey":"orth_live_YOUR_KEY"}' > ~/.config/orthogonal/credentials.json

Or set the environment variable:

export ORTHOGONAL_API_KEY=orth_live_YOUR_KEY

---

Billing

• Pay-per-use: Only pay for what you use
• No subscriptions: No monthly fees
• Add credits: https://orthogonal.com/dashboard/balance

Check your balance:

orth account

---

Integrations (OAuth-connected services)

In addition to paid APIs, Orthogonal supports OAuth-connected integrations for Gmail, Google Calendar, Slack, GitHub, Notion, Google Drive, and Google Sheets. These are free to use — the user connects their account via OAuth, then agents can call actions on their behalf.

Integrations use the same orth run command as paid APIs:

# Send an email via Gmail
orth run gmail /send-email -b '{"recipient_email": "[e-mail]", "subject": "Hello", "body": "Hi there"}'

# Create a Google Calendar event
orth run google-calendar /create-event -b '{"title": "Team standup", "start_time": "2025-03-10T10:00:00", "end_time": "2025-03-10T10:30:00"}'

# Send a Slack message
orth run slack /send-message -b '{"channel": "#general", "text": "Hello from Orthogonal!"}'

Check parameters before calling an integration action:

# See parameter names, types, and descriptions for any action
orth api show google-sheets /update-values

This shows required and optional parameters. Do not guess parameter names — always check first.

Available integrations:

Integration	Slug	Actions
Gmail	gmail	/send-email, /list-emails, /get-email, /create-draft
Google Calendar	google-calendar	/create-event, /list-events, /find-event, /delete-event
Slack	slack	/send-message, /list-channels, /fetch-history
GitHub	github	/create-issue, /list-repos, /create-pr, /star-repo
Notion	notion	/create-page, /search, /fetch-data, /add-content
Google Drive	google-drive	/find-file, /create-file, /get-file, /create-folder
Google Sheets	google-sheets	/create-spreadsheet, /get-sheet-names, /add-row, /lookup-row, /get-values, /update-values

Note: Integrations require the user to have connected their account at https://orthogonal.com/dashboard/integrations. If not connected, the API returns HTTP 428 with a link to connect.

---

Support

• Browse Skills: https://orthogonal.com/skills
• Browse APIs: https://orthogonal.com/discover
• Browse Integrations: https://orthogonal.com/integrations
• Documentation: https://docs.orthogonal.com
• Book a call: https://orthogonal.com/book