Integrate You.com web tools with Vercel AI SDK
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: ydc-ai-sdk-integration Version: 1.0.0 The skill bundle is benign. The `SKILL.md` provides instructions for an AI agent to guide a user through integrating the `@youdotcom-oss/ai-sdk-plugin` into their application. This involves installing a specific npm package, configuring API keys (reading `process.env.YDC_API_KEY` or a custom name), and modifying code to use the plugin. All actions, including shell commands for package installation and API key handling, are directly aligned with the stated purpose and do not show any signs of prompt injection, data exfiltration beyond the necessary API key for the plugin, or other malicious intent.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the package adds third-party code to the user's project.
The skill directs installation of an external package without a pinned version. This is expected for an SDK integration guide, but users should recognize it as a supply-chain dependency.
npm install @youdotcom-oss/ai-sdk-plugin # or bun add @youdotcom-oss/ai-sdk-plugin # or yarn add @youdotcom-oss/ai-sdk-plugin # or pnpm add @youdotcom-oss/ai-sdk-plugin
Install from the official package source, review the package/version, and pin or lock dependencies in the project as appropriate.
The integration will use a You.com API key to access You.com services.
The skill requires or guides use of a You.com API key, even though the registry metadata lists no required env vars or primary credential. This credential use is purpose-aligned for You.com tools.
Using standard `YDC_API_KEY`? ... Have they set it in their environment? ... Guide them to get key from https://you.com/platform/api-keys
Store the API key in environment variables or a secret manager, avoid committing it to source code, and scope/rotate the key according to You.com's guidance.
The user's application source code may be changed to add You.com tools.
The skill instructs the agent to modify project files, but it first asks whether files are existing or new and which files/tools to use, making the mutation user-directed and aligned with the integration purpose.
Update/Create Files ... Add import for selected tools ... Add selected tools to tools object
Review generated diffs before committing, and test the integration in a development branch before deploying.
User prompts or derived search/content-extraction requests may leave the application and be processed by You.com and the selected model provider.
The integration adds external You.com tools to AI SDK calls. This is the stated purpose, but prompts and tool queries may be sent to external providers.
tools: { search: youSearch() }, ... prompt: 'What are the latest AI developments?'Avoid sending secrets or regulated data in prompts unless the application's privacy and provider agreements allow it.