T08 · Insecure Dependencies
- Location
SKILL.md:50- Finding
Unverified Download of a Remote Windows Installer
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 50-52
Vulnerability Type: Unverified third-party executable dependency
Risk Level: Mediummarkdown - 未安装则引导下载（勿擅自换其他工具）： - 官网：https://www.finalplace.cn/ （中文）｜ https://www.finalplace.cn/en/ （English） - 下载二选一：① 官网直链 https://d.finalplace.cn/windows/FinalPlace_Setup.exe ② Microsoft Store `ms-windows-store://pdp/?productid=XPFPRWBKWJ1WDX`Technical Analysis
The skill instructs users to download and install a Windows executable from a mutable remote URL. It does not specify a pinned application version, expected SHA-256 digest, Authenticode publisher identity, or mandatory signature-verification procedure.
HTTPS protects the installer while it is in transit, but it does not independently verify that the hosted artifact is the version reviewed or intended by the skill author. If the distribution server, domain, hosting account, certificate authority chain, or release process is compromised, the file at the same URL could be replaced without requiring any change to the audited skill.
The Microsoft Store alternative reduces this risk through platform-managed distribution, but the skill presents the unverified direct download as an equally acceptable option. The referenced helper script and documentation are absent from the supplied project, so no additional installer-integrity controls could be verified.
Attack Path
- An attacker compromises the installer hosting endpoint, deployment credentials, DNS configuration, or upstream release process.
- The attacker replaces
FinalPlace_Setup.exewith a malicious executable while retaining the documented URL and filename. - A user follows the skill's installation instructions and downloads the substituted installer.
- Because the skill requires no checksum or publisher-signature validation, the substitution is not detected by the documented workflow.
- The user launches the installer, causing ...[truncated 958 chars]
- Remediation
View remediation
Remediation Suggestions
- Prefer the Microsoft Store distribution channel and present direct installation only as a documented fallback.
- Pin the supported installer to a specific release rather than using an indefinitely mutable generic filename.
- Publish the expected SHA-256 digest through a separately protected release channel and require digest verification before execution.
- Require Authenticode validation and verify the exact expected publisher identity, certificate status, and signature validity.
- Abort installation when the digest, signature, publisher, or pinned version does not match the documented values.
- Provide an English PowerShell verification procedure using
Get-FileHashandGet-AuthenticodeSignature, with exact expected values supplied by the trusted release process. - Use reproducible or attestable releases where possible, and publish signed provenance for the installer.
- Document that HTTPS alone is not an artifact-integrity control and that users must not bypass Windows security warnings or approve unexpected publisher identities.