Integrate You.com web tools with Vercel AI SDK

Integrate Vercel AI SDK applications with You.com tools (web search, AI agent, content extraction). Use when developer mentions AI SDK, Vercel AI SDK, generateText, streamText, or You.com integration with AI SDK.

This skill appears to do what it says (add You.com tools to Vercel AI SDK), but there are a few things to check before using it: - Metadata mismatch: The documentation requires a You.com API key (YDC_API_KEY or a custom env var) but the skill metadata does not declare any required env vars. Treat this as a red flag — ask the publisher to add a declared primaryEnv and requires.env entries. - Verify the npm package: The SKILL.md instructs installing @youdotcom-oss/ai-sdk-plugin. Before running npm install, verify the package owner, inspect the package source (or its GitHub repo), and check for suspicious postinstall scripts or unexpected permissions. Prefer installing from trusted, verifiable sources. - Supply-chain risk: Because the skill relies on a third‑party package you will install locally, consider running the install in a controlled environment (CI, container) and review the package contents. - API key handling: Never paste your private API key into a UI — set it as an environment variable in your deployment environment. Confirm the least-privilege scope for the key on the You.com platform and rotate/regenerate if needed. - Ask the publisher: Request that they update the registry metadata to list YDC_API_KEY (or allow specifying primaryEnv) and provide links to the package repository/homepage so you can audit the code. If you need higher assurance, ask the publisher for the package repository link and a cryptographic provenance (e.g., GitHub repo + npm package match) and consider a quick code review of the package before installing.

Type: OpenClaw Skill Name: ydc-ai-sdk-integration Version: 1.0.0 The skill bundle is benign. The `SKILL.md` provides instructions for an AI agent to guide a user through integrating the `@youdotcom-oss/ai-sdk-plugin` into their application. This involves installing a specific npm package, configuring API keys (reading `process.env.YDC_API_KEY` or a custom name), and modifying code to use the plugin. All actions, including shell commands for package installation and API key handling, are directly aligned with the stated purpose and do not show any signs of prompt injection, data exfiltration beyond the necessary API key for the plugin, or other malicious intent.