ARES Business Registry (CZ)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:08 AM UTC
• Version: 0.2.0

Overview

The skill mostly matches its ARES registry lookup purpose, but it includes an under-disclosed option that can send requests to arbitrary URLs instead of only the official ARES service.

Review this skill before installing. The core registry lookup behavior is coherent, but only use it in environments where outbound network access is acceptable, and avoid allowing prompts or untrusted inputs to set `--base`; ideally the skill should restrict requests to the official ARES host or remove that option outside tests.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/ares_client.py:440

Finding

Unrestricted API Base URL Enables SSRF-Like Outbound Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/ares_client.py, lines 272–273, 346–347, 353–367, and 440
Vulnerability Type: Unrestricted network destination / server-side request forgery
Risk Level: Medium

The client exposes an undocumented --base command-line option whose value is used directly to construct outbound request URLs. The code does not require HTTPS, restrict the destination to ares.gov.cz, reject private or loopback addresses, or validate redirect destinations.

python

def fetch_pravni_forma_from_ares(base: str) -> dict[int, str]:
    url = f"{base.rstrip('/')}/ciselniky-nazevniky/vyhledat"
    payload = http_json("POST", url, payload={"kodCiselniku": "PravniForma"})
    mapping: dict[int, str] = {}
    extract_codelist_pairs(payload, mapping)
    if mapping:
        return mapping
    raise AresError("Failed to decode codelist PravniForma", status=200, details={"url": url})

python

def fetch_ico(base: str, ico: str) -> dict[str, Any]:
    return http_json("GET", f"{base.rstrip('/')}/ekonomicke-subjekty/{ico}")

python

def fetch_search(
    base: str,
    name: str | None,
    city: str | None,
    nace: list[str] | None,
    limit: int,
    offset: int,
) -> dict[str, Any]:
    body: dict[str, Any] = {
        "pocet": limit,
        "start": offset,
        "razeni": [DEFAULT_SORT],
    }
    if name:
        body["obchodniJmeno"] = name
    if city:
        body["sidlo"] = {"nazevObce": city}
    if nace:
        body["czNace"] = nace
    if not name and not nace:
        raise ValidationError("search requires at least --name or --nace")
    return http_json("POST", f"{base.rstrip('/')}/ekonomicke-subjekty/vyhledat", payload=body)

python

parser.add_argument("--base", default=DEFAULT_BASE, help=f"ARES base URL (default: {DEFAULT_BASE})")

Technical Analysis

User-controlled args.base reaches the URL ...[truncated 2716 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --base option from production-facing commands if custom endpoints are not a genuine operational requirement.
2. If endpoint configurability is required, parse the URL with urllib.parse.urlsplit and enforce all of the following:
   • The scheme must be https.
   • The hostname must exactly equal ares.gov.cz.
   • Embedded user information must be rejected.
   • Unexpected ports must be rejected.
   • URL fragments and ambiguous malformed URLs must be rejected.
3. Disable automatic redirects or implement a redirect handler that validates every redirect destination against the same scheme, hostname, and port allowlist.
4. Perform validation immediately before each network request so no alternative call path can bypass it.
5. If non-production endpoints are necessary for tests, expose them only through a clearly gated development mechanism, such as a test-only dependency injection interface, rather than a general command-line option.
6. Add automated negative tests covering HTTP URLs, loopback addresses, private-network addresses, embedded credentials, alternate ports, hostname confusion, and redirects to prohibited destinations.
7. Document the permitted outbound destination and ensure deployment-level egress controls independently restrict this Skill to the official ARES host.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documentation describes capabilities that perform network access and write to a local cache file, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege gap: an agent or reviewer cannot reliably tell from the skill header what external actions the skill may take, increasing the risk of unintended network calls or filesystem writes when the skill is invoked.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.