Oops... how did I get logged-out so fast?

Your constructor, new(), should return a blessed object.   Usually, I define a separate init() method and, if I find that the constructor has been called with parameters, I first create the blessed object and then separately invoke that method to do the rest.

Any Perl object is, almost always, a hash.   It can therefore “hold on to” anything that it wants.   As for the YAML question, what will make the most sense for the user of this module?   If the YAML object is something that the client program will have already, and will otherwise be using for other purposes, then it makes sense to pass it in and keep it.   But maybe your object should, instead, create a YAML object for its own purposes, i.e. “on demand,” and never tell its user about it at all.

In the latter case, I normally would define an internal-only method, named _getYAML (following the human convention that a subroutine-name beginning with an underscore isn’t intended for outside use), which will always return a YAML object.   If it doesn’t already have one, it creates one on-the-fly and stashes away its location in a known-but-to-god field of the hash so that it can return the same object next time.   If you are dealing with some other module, in the course of your work, that you know might be able to trash such an object, well, your object has to know about that and to destroy its own known-but-to-god reference at the appropriate time (by setting the stash to undef).   Your object knows, so nobody else has to, and that’s a big-win for the users of your code because “it just works.™”