yield-optimization

SUSPICIOUS. The skill is purpose-aligned and its stated data flows appear to target official Yield.xyz and MoonPay services, not an unrelated exfiltration endpoint. However, it authorizes high-impact financial operations (buy, bridge, sign, broadcast, offramp) and includes an unpinned transitive skill install path via `npx clawhub@latest`, so the overall security risk is elevated even without evidence of malware or credential theft.