kimi-webbridge-dsh

The only integrity gate is the manifest fetched from the same CDN as the binary, and it is skipped entirely when that manifest is unavailable (`// Manifest unavailable (e.g. old pinned version) — install without checksum.` then `if (expectedSha !== null)` guards verification). With autoInstallDaemon/autoStartDaemon defaulting to true and the system prompt telling the model to call `status` before any browser work, an executable is downloaded into ~/.kimi-webbridge/bin, chmod 0755, renamed into place and spawned detached (line 431) with no digest pinned in the package. A compromised or mis-serv

installDaemonBinary is skipped whenever daemonBinPath() already exists, so a file planted at ~/.kimi-webbridge/bin/kimi-webbridge (only the executing user's own directory guards it) is run automatically on any status call while the daemon is down, detached with stdio ignored, i.e. silently and outliving the harness process. No shell is involved and privilege is the same user's, so this is persistence/hygiene rather than escalation.

Entry names are only prefix-filtered (entry.path.startsWith(TARBALL_PREFIX)) and then joined without normalising, so an archive path such as kimi-webbridge/../../../x passes the filter, becomes ../../../x and is written outside skill/ (after writeSkill already rm -rf'd the managed roots). Only reachable when a maintainer runs `npm run fetch-skill` against a malicious or corrupted upstream tarball; the script is not loaded by the runtime.