Kimi Desktop、未検証コードをインストールできるグループチャットアップデーターを同梱

Finding

Kimi Desktop 3.1.5 and 3.1.10 automatically install and update a separate Group Chat executable and three agent skills from mutable Moonshot CDN locations, while the Windows updater skips checksum verification and does not enforce the executable’s Authenticode signer before installation.

How we verified

Methods: reverse engineering, data analysis, documents.

RuntimeWire traced Kimi Desktop’s packaged updater from triggerKimiimColdStartCheck() through its download, fingerprinting, verification and installation logic.

The updater sets its release version to latest and downloads kimiim-cli from a mutable Moonshot CDN tree under:

https://kimi-img.moonshot.cn/pub/claw/tmp/lihuaru/skills/kimiim

It determines whether to update using an HTTP HEAD request and compares ETag, Last-Modified or content length with a locally stored fingerprint. The code does not pin a release version or require an authenticated release manifest.

Checksum verification is guarded by an operating-system condition equivalent to:

if (os !== "windows") { verifyChecksum(...) }

The live Windows ZIP contains kimiim-cli.exe without a checksum file. The installer does not call Get-AuthenticodeSignature, validate a certificate identity or otherwise enforce an expected signer before moving the executable into ~/.local/bin.

The installed executable is currently signed with a valid Moonshot Authenticode certificate. That signature is an important qualification: the artifact RuntimeWire examined was signed, while the updater code does not require future replacements to carry that signature.

The installer removes the previous target, renames the downloaded executable into ~/.local/bin/kimiim-cli.exe and permanently adds ~/.local/bin to the Windows user PATH.

Three agent skills are updated from mutable paths through the same ETag/Last-Modified mechanism:

kimiim/SKILL.md worker-safety/SKILL.md time-awareness/SKILL.md

The macOS archive includes a checksum beside its binary, although the checksum and binary arrive together through the same mutable download. The archive also retains developer packaging metadata, including AppleDouble files, quarantine and provenance attributes, and ownership metadata identifying houzhendong/staff.

The native executable identifies the Go module kimi.darkmatter/tools/kimiim-cli, commit 231e0b9d475dcc0d99db0da712477014d97f575c, and build time 2026-04-25T04:57:57Z.

RuntimeWire found no evidence that Moonshot’s CDN, publishing credentials or distributed artifacts have been compromised.

RuntimeWire extracted and examined the packaged JavaScript from Kimi Desktop 3.1.5 for Windows. We located the Group Chat cold-start function and followed its control flow through URL construction, update detection, checksum handling, installation and PATH modification.

We inspected the live Windows archive delivered by Moonshot, recorded its HTTP metadata, listed its contents and calculated SHA-256 hashes for the archive and executable. We used Windows Authenticode inspection to verify the executable’s current signature status and inspected Go build metadata and embedded strings without altering the binary.

We separately inspected the macOS archive structure, included checksum and retained packaging metadata.

We compared the relevant packaged updater code with Kimi Desktop 3.1.10 and confirmed that the mutable Group Chat update mechanism and Windows checksum exception remained present in that release.

For limited behavioral testing of the Group Chat CLI, we used a Linux build with a dummy token and a reporter-controlled loopback capture server. We did not connect a real Group Chat account, replace any Moonshot artifact or attempt to execute code on another user’s installation.

RuntimeWire disclosed the finding to Moonshot Security on Aug. 14, 2026. Moonshot was asked to acknowledge the disclosure by 6 p.m. CDT on Aug. 15 and was offered a short publication delay if remediation was underway. Moonshot did not reply before publication.

Tested versions:

• Kimi Desktop 3.1.5
• release identifier 3.1.5+c88420152
• Windows x64 Kimi Desktop 3.1.10
• release identifier 3.1.10+e0c4c9980
• Windows x64

Reproduction

RuntimeWire independently reproduced the core finding.

Requirements:

Kimi Desktop 3.1.5 or 3.1.10 for Windows x64 A disposable Windows test environment An ASAR extraction tool PowerShell No Group Chat token is required for static verification

Steps:

Obtain the official Kimi Desktop Windows release and extract its packaged app.asar. Search the extracted application for triggerKimiimColdStartCheck. Follow the call into the kimiim-cli installer and updater. Confirm that the configured version string is latest. Locate the Windows archive name kimiim-cli_windows_amd64.zip. Trace the HEAD request and confirm that update decisions use ETag, Last-Modified or content length. Locate the checksum branch and confirm that verifyChecksum(...) runs only when the operating system is not Windows. Download the publicly delivered Windows archive without executing its contents. List the archive and confirm that it contains kimiim-cli.exe without a checksum file. Calculate the archive and executable SHA-256 hashes. Run Get-AuthenticodeSignature against the extracted executable and record the signer and signature status. Confirm that the installer itself does not enforce that signer before placing the file in ~/.local/bin. Trace the Windows PATH modification and confirm that ~/.local/bin is added to the user PATH. Locate the three skill-download URLs and confirm that their update checks also rely on mutable resources and HTTP metadata. Repeat the static code check against Kimi Desktop 3.1.10 to confirm that the mechanism remains present.

Do not modify the remote archive, upload a replacement, use production credentials or attempt to affect another installation.

File hashes

• runtime reproduction.
• File hashes
• sha256:4ecfdc4ff9ad57707f050888056babeac79eb85b61c3e0a369b612d809f80122 Kimi Desktop 3.1.5 app.asar
• sha256:bc6a8c43ae3bff49c86cb91201cb36e618c6db4677c62379c6480c5fbc8ceab3 Kimi Desktop 3.1.10 app.asar
• sha256:a3e3620814e7bb095a20eb555c4c1a26a97e4954791f8f1225f7fc6a6f6e0fe6 kimiim-cli_windows_amd64.zip
• sha256:04ffb2bedc7a6a31b9805dbad070d27dc7220cec94931a6159ebad45800a49e6 kimiim-cli.exe

Company response

The company did not respond to requests for comment.