Mikrotik Routeros

Expert-level management of MikroTik RouterOS devices and VSOL GPON OLTs via SSH or RouterOS API (port 8728/8729) and REST API (port 80/443). Use this skill w...

Things to check before installing or running this skill: - Verify metadata: confirm the skill registry entry matches SKILL.md (required binaries and env vars). If the registry lists no required env vars but SKILL.md does, the UI may not prompt you correctly for credentials. - Audit local-file access: the bundled Python client will read ~/.openclaw/workspace/TOOLS.md to discover devices. Remove any plaintext passwords from that file or avoid storing credentials there. Prefer SSH keys (MIKROTIK_KEY) and set passwords only in a secure secret store/environment variables when needed. - Vet third‑party code: the references and scripts instruct fetching code from https://rsc.eworm.de and advise installing eworm scripts on routers. Review those scripts yourself before importing them into production routers—they run with router privileges. - Host modifications: SKILL.md suggests 'pip3 install --break-system-packages' and using sshpass. Only run these commands in a controlled environment (container or CI runner) if you understand implications for the host OS package management. - Least privilege: create a management account on devices with only the permissions the automation needs (avoid full admin if possible), and restrict RouterOS API/SSH access to management subnets. - Operational caution: when the skill proposes destructive commands (reboot, remove, change firewall), require explicit confirmation. Consider running in read/diagnose-only mode first. If you cannot review the external scripts (rsc.eworm.de, Evolution API examples) and you cannot guarantee TOOLS.md/ENV secrecy, treat this integration as higher risk and do not install it on sensitive systems until vetted.

Type: OpenClaw Skill Name: mikrotik-routeros-isp Version: 2.0.5 The skill bundle provides comprehensive ISP management tools but includes high-risk patterns, most notably the automated fetching and execution of remote scripts. In 'references/eworm-scripts.md', instructions are provided to download and run RouterOS scripts directly from 'rsc.eworm.de', which functions as a 'curl|bash' equivalent for network infrastructure. Additionally, 'scripts/mikrotik_api.py' is designed to read and parse the 'TOOLS.md' file within the OpenClaw workspace to extract device credentials. While these capabilities are aligned with the stated purpose of advanced ISP automation, the combination of remote code execution and broad workspace file access for secrets poses a significant security risk.