Mikrotik RouterOS

Manage MikroTik RouterOS devices via API to view status, firewall, network config, logs, users, backups, and run custom commands across multiple devices.

This skill appears to implement a MikroTik API client and local network scanner, which fits the stated purpose — but there are several red flags you should consider before installing or running it: - Network scanning: The skill actively probes local subnets (threads, TCP connects to 8728/8729) and runs system commands (ip/ipconfig/arp). Run only on isolated/test networks or with explicit admin approval to avoid alerts or policy violations. - Credentials handling: SKILL.md suggests storing passwords in ~/.openclaw/workspace/TOOLS.md (plaintext) and/or environment variables. Do not store real admin credentials in plaintext. Prefer temporary accounts, scoped credentials, or using the CLI arguments for short-lived sessions; rotate/delete credentials after use. - Metadata vs instructions mismatch: The manifest does not declare the environment variables or handler files documented in SKILL.md/README. That inconsistency could indicate sloppy packaging or missing integration code — review the bundled files carefully before use. - Code quality issues: The included client/scanner code uses subprocess with shell=True and has some fragile/buggy logic (e.g., response parsing/login heuristics). These are not proof of malicious intent, but they increase risk of runtime failures or unexpected behavior; review the source and test in a safe environment. Recommendations: review the skill's source code yourself (or have an administrator do so), test only on an isolated lab network, avoid putting production admin passwords into TOOLS.md, and prefer temporary or least-privileged accounts. If you can't audit the code or the source is untrusted, do not run the scanner or any automated scans on production networks.

Type: OpenClaw Skill Name: mikrotik-routeros Version: 2026.3.30 The skill provides extensive MikroTik RouterOS management capabilities, including the execution of arbitrary commands on remote devices (client.py) and active network scanning (scanner.py). It uses subprocess to call system utilities like ipconfig, ip addr, and arp to discover local subnets and device MAC addresses. While these high-risk behaviors are documented and aligned with the tool's stated purpose, the combination of network discovery, shell-out logic, and remote command execution warrants a suspicious classification under the provided criteria.