Security audit

Mikrotik

Security checks for vulnerabilities and agentic risk

Overview

This skill is for router administration, but it handles powerful network access and router credentials in ways users should review carefully before installing.

Install only in a network you administer and preferably in a lab or isolated management environment. Do not put real router administrator passwords in TOOLS.md or command-line arguments, avoid blank/default admin credentials, prefer a least-privileged RouterOS account, and treat scanning plus custom commands as potentially disruptive operations that need explicit approval.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: mikrotik-api/scanner.py:120
Finding: Automatic Local-Network Reconnaissance and Default-Credential Authentication Attempts
Content: View full analysis
Optional[Dict]: try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(self.timeout) result = sock.connect_ex((ip, self.API_PORT)) if result == 0: mac = arp_macs.get(ip, 'Unknown') is_mikrotik = mac != 'Unknown' and any( mac.startswith(oui) for oui in self.MIKROTIK_OUIS ) device = { 'ip': ip, 'mac': mac, 'port': self.API_PORT, 'identity': 'Unknown', 'model': 'Unknown', 'version': '', 'source': 'api_port', 'is_mikrotik': is_mikrotik } if is_mikrotik: try: from client import MikroTikAPI api = MikroTikAPI(ip, 'admin', '', timeout=2) if api.connect(): if api.login(): result = api.run_command('/system/identity/print') if result: device['identity'] = result[0].get('name', 'Unknown') result = api.run_command('/system/resource/print') if result: device['version'] = result[0].get('version', '') api.disconnect() except: pass ``` The scan is applied to every usable address in locally discovered subnets: ```python for ip_int in range(network_masked + 1, broadcast): ip = socket. ...[truncated 2286 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: handler.py:28
Finding: Plaintext Router Administrator Credentials in a Shared Workspace File
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: mikrotik-api/client.py:14
Finding: Router Administrator Credentials Transmitted Through an Unencrypted Management Protocol
Content: View full analysis
bool: try: self.sock = socket.create_connection( (self.host, self.port), timeout=self.timeout ) self.sock.setblocking(0) self.connected = True return True except Exception as e: print(f"Connection failed: {e}") return False ``` ```python def login(self) -> bool: if not self.sock: return False try: self._send_word('/login') self._send_word(f'=name={self.username}') self._send_word(f'=password={self.password}') self._send_word('') response = self._recv_response(timeout=3.0) ``` ### Technical Analysis The client defaults to RouterOS API port 8728 and creates a raw TCP socket. It does not wrap that socket in TLS and does not perform certificate or hostname verification. The username and password are then transmitted as RouterOS API words over this unencrypted connection. Although the scanner checks whether port 8729 is open, the management client contains no TLS implementation for API-SSL. Merely changing the port to 8729 would not be sufficient because TLS negotiation and certificate validation are absent. An attacker able to observe or alter traffic on the local network can intercept credentials and management responses or manipulate unauthenticated transport data. ### Attack Path 1. The user configures valid RouterOS administ ...[truncated 947 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: handler.py:1237
Finding: Unrestricted Privileged RouterOS Command Execution Without Safety Controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: mikrotik-api/cli.py:27
Finding: Router Password Accepted Through Process Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README explicitly tells users to give router usernames and passwords to the AI and states that the configuration will be saved to TOOLS.md, but it does not clearly warn that this results in persistent plaintext credential storage. Router admin credentials are highly sensitive; exposing them can allow full device takeover, firewall/routing changes, traffic interception, or lateral movement across the local network.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions direct users to provide router credentials to the AI and persist them in a tool file, creating a direct secret-handling vulnerability. In the context of a router-management skill, these credentials are especially dangerous because compromise enables administrative control over network edge devices, traffic policy, VPNs, and potentially downstream systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manual configuration example embeds device names, IPs, usernames, and passwords directly in TOOLS.md, normalizing plaintext storage of infrastructure credentials. If that file is read by other tools, checked into repositories, synced, or exposed through the agent workspace, attackers gain privileged access to routers and potentially the entire managed network.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The example encourages users to store MikroTik credentials in plaintext within ~/.openclaw/workspace/TOOLS.md, a location likely accessible to the agent and potentially other processes, backups, or version control. This materially increases the chance of credential leakage and subsequent unauthorized access to network infrastructure.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This section repeats the unsafe pattern of placing sensitive router login details in a plaintext shared file, reinforcing insecure operator behavior. Repetition in setup guidance makes accidental credential exposure more likely and broadens attack surface through logs, screenshots, sync tools, or agent-readable workspace content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This skill context is especially dangerous because it targets network infrastructure and the documentation indicates active subnet scanning, local network inspection, API port probing, and even attempts to log in with the default admin account and empty password. In an enterprise or production environment, that crosses from administration into intrusive discovery and potentially unauthorized access behavior, which can trigger alerts or compromise weakly configured devices.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This skill context is especially dangerous because it targets network infrastructure and the documentation indicates active subnet scanning, local network inspection, API port probing, and even attempts to log in with the default admin account and empty password. In an enterprise or production environment, that crosses from administration into intrusive discovery and potentially unauthorized access behavior, which can trigger alerts or compromise weakly configured devices.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Wireless client enumeration exposes MAC addresses, IPs, SSIDs, signal metrics, uptime, and traffic statistics for connected clients. This is sensitive endpoint and usage data that can reveal user presence, device identity, and network behavior, creating privacy and operational security risks if shown without explicit warning or authorization.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill includes an active local-network scanning capability (MikroTikScanner.scan()) that operates independently of configured target devices. This exceeds the stated purpose of connecting to and managing specified MikroTik devices and enables reconnaissance of the broader environment, which could expose unauthorized assets and expand attack surface knowledge.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill directly executes user-supplied RouterOS commands on the target device, enabling arbitrary remote administrative actions. Because there is no safety interlock, allowlist, or high-risk-operation confirmation, a user prompt or downstream agent misuse could disable protections, alter routing/firewall state, create accounts, or otherwise compromise the router.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The shutdown() method immediately powers down the device without any safeguard. For an infrastructure device, shutdown is more disruptive than read operations and can cause prolonged outage until manual intervention restores service, making accidental or unauthorized use particularly damaging.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The code attempts to log into discovered devices using the username 'admin' with an empty password. This is dangerous because it operationalizes default-credential probing against network devices, which can lead to unauthorized access, violate policy, and normalize credential abuse even if intended for convenience.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Attempting 'admin' with a blank password against discovered devices without prominent user notice is an unsafe authentication probe. In this skill context, it materially increases danger because the feature is embedded in a device-management tool where users may not realize it is performing credential attacks rather than just connecting to known equipment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The scanner performs broad active discovery across local subnets and, for matching devices, escalates to connection and authentication attempts. That goes beyond passive device management and creates potentially unauthorized reconnaissance and access behavior on the user's network, especially dangerous in an agent skill that may be run with little scrutiny.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: Nearly all user-facing instructions, examples, and invocation phrases are provided only in Chinese, including the explicit spoken passphrase and command examples. Under the stated policy, forcing a specific language without opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Advertising automatic LAN scanning 'without configuration' encourages active probing of the local network without clearly warning users that device discovery may reveal host/IP/MAC information and may be unauthorized in some environments. In a network-management skill, scanning is contextually relevant, but silent or under-warned probing can still create privacy, policy, and detection risks.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises capabilities that involve reading local files, consuming environment variables, and invoking shell-backed functionality, but it does not declare any explicit tool scope or permissions boundaries. This creates a transparency and least-privilege problem: an agent or user may invoke the skill without realizing it can access credentials, local configuration, and perform host/network actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The configuration section encourages storing router credentials in TOOLS.md and environment variables before presenting strong warnings, which normalizes insecure handling of high-value administrative secrets. Given the skill manages routers and supports custom commands, exposed credentials could directly enable device compromise or broader network access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases are broad enough to match ordinary troubleshooting requests, increasing the chance of unintentional invocation of a privileged network-management skill. In this context, accidental activation is risky because the skill can access router state, credentials, and potentially execute commands against infrastructure devices.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Generic examples for backup, cleanup, API configuration, and scanning increase the likelihood that destructive or sensitive operations are triggered from ambiguous natural-language requests. Because these actions can alter device state, expose management interfaces, or enumerate networks, accidental matching has real operational and security consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The user/account display functionality reveals potentially sensitive administrative information, including usernames and service exposure, without any privacy notice or minimization. Such data can help an attacker identify privileged accounts, enabled services, and management interfaces for follow-on attacks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: DHCP lease output reveals client IP addresses, MAC addresses, hostnames, and statuses without any warning or access control. This inventory data is highly useful for mapping internal endpoints and can expose personal or business-sensitive device information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The implementation exposes extensive topology and infrastructure data such as neighbors, active connections, routing peers, wireless clients, DHCP leases, ARP tables, and scheduler contents. While some of this may aid administration, aggregating and displaying this breadth of reconnaissance data goes beyond a narrow device-management scope and can materially assist lateral movement or targeting if misused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill performs active network scanning without an explicit user-facing warning that it will probe the local network. In managed or sensitive environments, such probing can violate policy, trigger monitoring alerts, or enumerate assets the user did not intend to inspect.
Content: No source excerpt is available for this finding.