T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:37- Finding
Router Credentials and Administrative Traffic Transmitted over an Unencrypted API Connection
- Content
View full analysis
- Remediation
View remediation
Security audit
MikroTik API
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-built for MikroTik router administration, but its examples use unsafe connection and installation defaults that could expose router credentials or affect sensitive infrastructure.
Review before installing. Use this only with a least-privilege MikroTik account, prefer TLS on port 8729 with certificate and hostname verification enabled, avoid curl commands that place passwords on the command line, and install dependencies in an isolated virtual environment rather than modifying system Python.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:55- Finding
TLS Certificate and Hostname Verification Disabled for Router Management Connections
- Content
View full analysis
/rest/ip/address ``` REST API Python examples: ```python import requests from requests.auth import HTTPBasicAuth base = 'https:///rest' auth = HTTPBasicAuth('', '') # GET all interfaces r = requests.get(f'{base}/interface', auth=auth, verify=False) print(r.json()) # POST (run commands with parameters) r = requests.post(f'{base}/ip/address/print', auth=auth, verify=False, json={'_proplist': ['address', 'interface']}) print(r.json()) ``` ### Technical Analysis All documented TLS connection methods disable certificate validation: - `ssl_verify=False` disables certificate-chain verification. - `ssl_verify_hostname=False` disables validation that the certificate belongs to the intended router. - `curl -k` accepts invalid and untrusted certificates. - `requests(..., verify=False)` disables certificate verification in Python. TLS encryption without peer authentication does not establish that the endpoint is the intended router. An attacker able to intercept routing, DNS, ARP, Wi-Fi, or gateway traffic can present an arbitrary certificate and impersonate the router. Because the client accepts that certificate, the attacker can terminate TLS, inspect credentials and requests, and establish a separate connection to the real router. The network connection itself is required for the declared functionality, but disabling authentication of the remote endpoint is unnecessary and exposes highly privileged operati ...[truncated 1463 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:488- Finding
Router Passwords Embedded in Curl Command-Line Arguments
- Content
View full analysis
/rest/ip/address # PUT - Create new entry curl -k -u user:pass -X PUT https:///rest/ip/address \ --data '{"address":"192.168.1.1/24","interface":"ether1"}' \ -H "content-type: application/json" # PATCH - Update entry curl -k -u user:pass -X PATCH https:///rest/ip/address/*1 \ --data '{"comment":"updated"}' -H "content-type: application/json" # DELETE - Remove entry curl -k -u user:pass -X DELETE https:///rest/ip/address/*1 # POST - Run any command curl -k -u user:pass -X POST https:///rest/ip/address/print \ --data '{"_proplist":["address","interface"]}' \ -H "content-type: application/json" ``` ### Technical Analysis The examples place the username and password directly in the curl `-u` argument. When users replace `user:pass` with real credentials, the password may be retained or exposed through: - Interactive shell history. - Process command-line inspection. - Terminal session recording. - CI/CD logs and Agent execution traces. - Monitoring, auditing, or endpoint telemetry. - Copied command transcripts and support records. Although some curl implementations may attempt to obscure credentials in process listings after startup, this behavior is not a reliable security boundary and does not protect shell history or execution logs. ### Attack Path 1. A user or Agent copies a documented curl command. 2. The placeholder is replaced with a valid RouterOS username and password. 3. The command is executed in a shell or automated environment. 4. The complete command is saved in shell history, an Agent transcript, process telemetry, or a CI log. 5. A local user, log reader, support operator, or attacker with access to those records retrieves the cr ...[truncated 618 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:12- Finding
Unpinned Third-Party Package Installed into the System Python Environment
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
The documentation presents copy-pastable
curlcommands with placeholders for credentials, arbitrary REST paths, and disabled certificate checks. In a high-privilege router-management context, that combination can facilitate parameter abuse, accidental destructive operations, and credential exposure if users adapt the examples without understanding the risks.- Content
RouterOS 7.1+ also supports a REST API over HTTP/HTTPS. Use when the Python library is unavailable.
REST via curl
bash # GET - Read resources curl -k -u user:pass https://<IP>/rest/ip/address
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Explicitly setting
ssl_verify=Falsein the primary SSL example normalizes insecure transport behavior. Given the administrative power over firewall, routing, VPN, and system functions, users copying this pattern could compromise both credentials and device integrity.- Content
md password=password, plaintext_login=True, use_ssl=True, ssl_verify=False, # Set True with proper certs ssl_verify_hostname=False, port=8729 )
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Explicitly setting
ssl_verify=Falsein the primary SSL example normalizes insecure transport behavior. Given the administrative power over firewall, routing, VPN, and system functions, users copying this pattern could compromise both credentials and device integrity.- Content
md password=password, plaintext_login=True, use_ssl=True, ssl_verify=False, # Set True with proper certs ssl_verify_hostname=False, port=8729 )
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
RouterOS 7.1+ also supports a REST API over HTTP/HTTPS. Use when the Python library is unavailable.
REST via curl
bash # GET - Read resources curl -k -u user:pass https://<IP>/rest/ip/address
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The REST examples include real credential-bearing requests while disabling TLS validation (
-k,verify=False) and do not place an explicit warning immediately around those examples. That creates a meaningful risk of credential interception or man-in-the-middle attacks, especially because this skill is for managing network infrastructure and may be copied verbatim by users.- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md # DELETE - Remove entry curl -k -u user:pass -X DELETE https://<IP>/rest/ip/address/*1 # POST - Run any command curl -k -u user:pass -X POST https://<IP>/rest/ip/address/print \ --data '{"_proplist":["address","interface"]}' \ -H "content-type: application/json"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
POST - Run any command
curl -k -u user:pass -X POST https:///rest/ip/address/print
--data '{"_proplist":["address","interface"]}'
-H "content-type: application/json"text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
POST - Run any command
curl -k -u user:pass -X POST https:///rest/ip/address/print
--data '{"_proplist":["address","interface"]}'
-H "content-type: application/json"text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
POST - Run any command
curl -k -u user:pass -X POST https:///rest/ip/address/print
--data '{"_proplist":["address","interface"]}'
-H "content-type: application/json"text
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The Python REST example uses
verify=False, which disables server certificate validation and exposes Basic Auth credentials to interception by a man-in-the-middle. In a router administration skill, users may run these examples against sensitive infrastructure, raising the practical risk.- Content
md auth = HTTPBasicAuth('<USER>', '<PASS>') # GET all interfaces r = requests.get(f'{base}/interface', auth=auth, verify=False) print(r.json()) # POST (run commands with parameters)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md print(r.json()) # POST (run commands with parameters) r = requests.post(f'{base}/ip/address/print', auth=auth, verify=False, json={'_proplist': ['address', 'interface']}) print(r.json())
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
This POST example again disables TLS verification while sending authenticated management traffic. Since POST requests may trigger administrative actions, exploitation via MITM could expose credentials and manipulate or observe sensitive operations.
- Content
POST (run commands with parameters)
r = requests.post(f'{base}/ip/address/print', auth=auth, verify=False, json={'_proplist': ['address', 'interface']}) print(r.json())
text