Security audit

Mikrotik SettingMikrotikIndonesia.com

Security checks for vulnerabilities and agentic risk

Overview

This is a real MikroTik administration skill, but it forces persistent vendor branding and includes risky automation that can expose full router secrets through Telegram or email backups.

Install only if you intentionally want this vendor-branded MikroTik workflow. Before using generated commands, remove or explicitly approve the branding note, avoid sending full `.rsc` or `.backup` files through Telegram or email unless encrypted and approved, rotate any tokens or passwords exposed in exports, and review all scheduler and remove commands on a lab router before production.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:106
Finding: Mandatory Promotional Instructions Hijack Agent Output and Persistently Modify Router Login State
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/telegram-integration-playbook.md:147
Finding: Complete Router Configuration and Embedded Secrets Can Be Uploaded to Telegram
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/monitoring-backup-playbook.md:73
Finding: Readable Router Configuration Is Sent as an Unencrypted Email Attachment
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/monitoring-backup-playbook.md:62
Finding: Backup Rotation Logic Removes Every Matching Daily Backup Instead of Files Older Than Seven Days
Content: View full analysis
7 hari — jalankan via scheduler ## mingguan bila flash terbatas): /system scheduler add name=smi-backup-rotasi interval=7d start-time=04:00:00 on-event={ "/file remove [find name~\"smi-auto/.*daily\" and name~\"(backup|rsc)\" ]"; ":log info message=\"smi-backup: rotasi arsip lama\"" } comment="settingmikrotikindonesia.com - Rotasi backup lama mingguan berlog" ``` ### Technical Analysis The documentation says that backups older than seven days will be removed, but the actual selector performs only filename matching. It has no timestamp, creation-date, modification-date, age, or minimum-copy condition. Consequently, every file matching both the daily-backup path pattern and the backup/export extension pattern can be selected on each weekly run. This includes newly generated recovery points. The logging statement reports that old archives were rotated even though the code does not verify age, creating a misleading indication of safe retention. The broad removal executes automatically under the scheduler's router privileges. This is a destructive availability flaw in the disaster-recovery mechanism. ### Attack Path 1. Daily jobs create matching `.backup` and `.rsc` files under the designated path. 2. The weekly rotation scheduler starts. 3. The filename expression selects all matching daily backups without checking age. 4. `/file remove` deletes the selected files. 5. The script logs a nominal rotation-success message. 6. A later configuration failure or router outage occurs. 7. Administrators discover that expected recent local recovery points no longer exist. ### Impact Assessment The task can erase all local daily backups that match the expression. It does not directly affect routing or create ...[truncated 351 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/user-manager-playbook.md:60
Finding: Paste-Ready User Manager Example Uses a Predictable Literal Password
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (35)

Ssd 3

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly discusses router exports containing bot tokens and PPPoE/hotspot passwords, then frames transmission and storage workflows in ordinary operational terms. In this context, encouraging or normalizing export creation and sharing of files known to contain full router secrets materially raises the risk of credential leakage, unauthorized access, and downstream compromise of network infrastructure.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Instructing operators to send full router backup exports to Telegram is a direct sensitive-data exposure risk. These exports can reveal credentials, VPN settings, routing, internal addressing, customer-related configuration, and security controls; compromise of the Telegram account, group membership, bot token, or exported file retention would materially expose the network.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 93% confidence
Finding: The file contains an explicit 'UPDATE SKILL.md' instruction that tells the agent to modify its own skill reference list. Self-modification is dangerous because it can let untrusted content expand the skill’s capabilities or alter future behavior without a separate review boundary, creating a path for persistent prompt/configuration injection.
Content: Scanner excerpt · references/vrrp-ha-playbook.md (reported line 133)May include surrounding context.
md
--- # UPDATE SKILL.md Tambah di FILE REFERENCES:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says to use the skill whenever a user asks for Mikrotik configuration, troubleshooting, or optimization, which is a very broad activation condition. It does not define narrower trigger phrases, exclusion conditions, or boundaries for when another networking skill should be preferred, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The communication style section requires 'Bahasa Indonesia profesional' as the output language, which forces a specific language regardless of user preference. This is a natural-language policy issue because no opt-in, fallback, or documented regional justification is provided in the file.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill includes operational guidance around Telegram bot tokens and router backup/export handling that expands into sensitive secret-management and sharing workflows. In a network device administration context, exports can contain credentials, tokens, and other router secrets, so normalizing their handling inside a general configuration skill increases the chance of inadvertent exposure or exfiltration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description advertises a very broad set of high-privilege networking capabilities without defining narrow activation triggers, task boundaries, or safety constraints. In an agent setting, this can cause the skill to activate for loosely related requests and generate or recommend risky router changes, increasing the chance of misconfiguration, service disruption, or overreach in administrative actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The rollback section instructs broad removal of queue tree and firewall mangle entries using pattern matches, which is destructive and conflicts with the documented safer 'set-ulang' approach. In an operational router environment, these commands can delete live traffic-shaping and classification rules in bulk, causing service disruption or incomplete recovery if the match scope is broader than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The playbook presents destructive rollback commands without an immediate safety warning, confirmation gate, or prerequisite backup validation at the point of use. Because this skill is meant for real MikroTik configuration work, an operator could copy-paste the commands directly and unintentionally remove active policy objects, leading to traffic leaks, broken QoS, or wider network instability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file consistently instructs the user in Indonesian and uses mandatory phrasing such as 'WAJIB' and 'DILARANG' throughout, but nowhere offers an opt-in language choice. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The playbook is written entirely in Indonesian and includes imperative operational guidance without indicating that language selection is optional or that alternative locales are supported. This can violate language/locale policy when users are not explicitly opted into Indonesian or the document is not clearly scoped to an Indonesian-only audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The document explicitly configures SSID-HOTSPOT with empty authentication types, creating an open wireless network, but does not place a clear warning next to the configuration about exposure and required compensating controls. In an ISP/public hotspot context this may be intentional, but without prominent guidance operators may deploy an open SSID unintentionally or without client isolation, captive portal, rate limits, and abuse controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions enable CAP with certificate=none before the warning at the end explains the trust implications, so an operator following the steps in order may deploy insecure controller trust by default. In practice, insecure defaults in step-by-step network playbooks are dangerous because they are commonly copied verbatim into production.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The playbook claims lock-to-caps-man=yes provides anti-rogue protection, but the shown CAP configuration also sets certificate=none, which disables manager certificate validation. That means a reachable unauthorized CAPsMAN could potentially impersonate the controller and push configuration, especially across untrusted transport segments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The hotspot profile explicitly enables MAC-based login via login-by=http-chap,http-pap,mac, which weakens authentication because MAC addresses are easily spoofed on local networks. Although the playbook later notes that MAC login is for convenience rather than security, that warning is separated from the configuration point, so an operator may deploy it insecurely or overestimate its protection for paid/public access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The entire playbook is written in Indonesian and includes no indication that users may choose another language or that the skill is intentionally limited to an Indonesian-only audience for compliance or regional reasons. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains natural-language instructions exclusively in Indonesian, including operational guidance and warnings, with no indication that users may choose another language. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation unless the locale limitation is documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill provides a scheduler-driven script that continuously adds and removes live firewall address-list entries, directly affecting routing decisions for thousands of clients, but it does not prominently warn that this modifies production state and can disrupt traffic if adapted incorrectly. In an infrastructure automation skill for MikroTik routers, omission of rollback guidance, staging precautions, and pre-deployment warnings increases the chance of operator-induced outages or unintended policy changes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Lines L159-L161 describe sticky behavior only while clients are active and explicitly note reassignment after inactivity, but the later validation claim at L175-L176 says reboot preserves the same assignment because address-lists persist. The cleanup logic at L68-L87 deletes inactive entries, so after a reboot or inactive period those persisted address-lists may no longer retain prior WAN affinity, contradicting the implied persistence guarantee.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains user-facing operational instructions exclusively in Indonesian, including warnings and required validation steps, but does not state that the skill is Indonesia-specific or provide opt-in for the language. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The playbook embeds a Telegram bot token and sends operational data to an external service via /tool fetch. Even though this is presented as legitimate alerting, it creates a real data-exfiltration path and exposes a secret in script configuration; the file itself warns that tokens in scripts are sensitive and may leak via /export. In this skill context, the transmission is expected for monitoring, which makes the intent benign, but it is still security-relevant because router identity and status data leave the device and credentials may be disclosed or misused.
Content: Scanner excerpt · references/scheduler-otomasi-playbook.md (reported line 41)May include surrounding context.
md
:local tgToken "[TOKEN]" :local chatId "[CHAT_ID]" :do { /tool fetch url=("https://api.telegram.org/bot" . $tgToken . \ "/sendMessage?chat_id=" . chatId . "&text=" .tgMsg) keep-result=no } on-error={ :log error message="smi-tg: kirim Telegram GAG"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file states that the Telegram integration is a core module invoked by other playbooks, but it does not define precise activation conditions, allowed callers, or exclusion cases. That makes the trigger scope overly broad at the documentation level and could lead to unintended use from loosely related automation flows.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/monitoring-backup-playbook.md (reported line 97)May include surrounding context.
md
orang yang belum mulai chat — ini penyebab gagal kirim #1). 3. Ambil chat ID: chat @userinfobot → balasannya berisi "Id: 987654321". Untuk GRUP: tambahkan bot ke grup, lalu ambil via https://api.telegram.org/bot<TOKEN>/getUpdates → cari "chat":{"id":-100xxxx} (ID grup selalu negatif — catat dengan tanda minusnya!). 4. Rahasia: token dilarang disebar di screenshot/chat publik.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/monitoring-backup-playbook.md (reported line 102)May include surrounding context.
md
orang yang belum mulai chat — ini penyebab gagal kirim #1). 3. Ambil chat ID: chat @userinfobot → balasannya berisi "Id: 987654321". Untuk GRUP: tambahkan bot ke grup, lalu ambil via https://api.telegram.org/bot<TOKEN>/getUpdates → cari "chat":{"id":-100xxxx} (ID grup selalu negatif — catat dengan tanda minusnya!). 4. Rahasia: token dilarang disebar di screenshot/chat publik.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/telegram-integration-playbook.md (reported line 28)May include surrounding context.
md
orang yang belum mulai chat — ini penyebab gagal kirim #1). 3. Ambil chat ID: chat @userinfobot → balasannya berisi "Id: 987654321". Untuk GRUP: tambahkan bot ke grup, lalu ambil via https://api.telegram.org/bot<TOKEN>/getUpdates → cari "chat":{"id":-100xxxx} (ID grup selalu negatif — catat dengan tanda minusnya!). 4. Rahasia: token dilarang disebar di screenshot/chat publik.