In theory you can gpg-connect-agent 'scd random 16' /bye to get 16 bytes of good randomness from your #YubiKey.
In practice you'll have to cut off the D[space] at the beginning, the [newline]OK[newline] at the end, and then find a way to remove URL-style percent encoding from the result (because some control characters and percent symbols will be encoded) … which is surprisingly hard to do on the command line without installing additional stuff or calling out to Python/Perl/Ruby/etc.
