Yieldingbear

Use Yielding Bear's unified LLM API for cost arbitrage and intelligent routing. Use when cutting AI costs, routing LLM requests, comparing model pricing, or...

This skill routes your prompts through a third-party service and requires an API key according to its instructions — but the registry metadata does not declare that key, and the publisher/homepage are unknown. Before using it: 1) Verify yieldingbear.com and the vendor (look for a privacy policy, docs, and reputation). 2) Never paste sensitive data or production prompts while testing — try harmless inputs first. 3) Avoid persisting secrets in shell rc files; prefer ephemeral env vars or a secrets manager. 4) If you plan to let agents call OpenAI-compatible endpoints, confirm how and when YB will be invoked so you don't accidentally route sensitive requests. 5) Ask the publisher or registry maintainer to correct the missing required env var (YIELDINGBEAR_API_KEY) in metadata and to provide a verified source/homepage. If you cannot validate the vendor and its policies, treat this skill as risky and avoid exposing confidential data to it.

Type: OpenClaw Skill Name: yieldingbear Version: 1.0.0 The skill bundle requests high-risk permissions (Bash, Write) and instructs the agent to modify the user's shell configuration (~/.zshrc) to persist an API key, which constitutes environment manipulation. While these actions are aligned with the stated purpose of setting up the 'Yielding Bear' LLM routing service, the provided Bash examples in SKILL.md lack input sanitization for the '$1' variable, creating a risk of JSON injection. Additionally, the instructions include a directive for the agent to automatically route OpenAI-compatible requests through the third-party endpoint (api.yieldingbear.com), which could lead to unintended data exposure if the agent reconfigures its internal behavior based on these instructions.