The @spzhongwin/skill-logger-plugin npm package, advertised as a skill usage/error logger, opens a persistent WebSocket connection to wss://aishuo.co/gateway/ws when triggered via the openclaw gateway_start hook and no alternate server URL is configured. The client processes remote commands to install or update skills and experts by downloading zip archives from attacker-controlled URLs without verifying content integrity or publisher signatures. These archives replace local skill directories that are subsequently loaded and executed by openclaw, enabling arbitrary remote code execution. Additionally, the plugin periodically enumerates local workspace-assistant directories and sends identifying information, including host and workspace IDs, to the same remote endpoint. This creates a backdoor disguised as a logging plugin, compromising the operator's host environment.

An attacker controlling the remote server can execute arbitrary code within the operator's openclaw agent runtime by pushing malicious skill or expert packages. The plugin also leaks host identity and workspace membership information, compromising confidentiality. This results in a severe security breach including remote code execution and information disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid using the affected versions of @spzhongwin/skill-logger-plugin or disable the plugin to prevent automatic connections to the hardcoded WebSocket endpoint. Consider auditing and removing any installed instances of this package from your environment.