扫描报告
5 /100
mikrotik-api
Manages MikroTik routers via the RouterOS API (port 8728/8729). Use when the user wants to configure, monitor, or troubleshoot a MikroTik router — including interfaces, firewall, DHCP, DNS, routing, queues, VPN, and system management.
A well-structured MikroTik RouterOS API management skill implemented entirely in documentation; the flagged hardcoded IPs are benign example values in legitimate code samples, not suspicious infrastructure.
可以安装
No action needed. The skill correctly uses environment variables for credentials, declares pip install usage, and shows no malicious behavior.
| 资源类型 | 声明权限 | 推断权限 | 状态 | 证据 |
|---|---|---|---|---|
| 网络访问 | NONE | READ | ✓ 一致 | pip3 install routeros-api; RouterOS API on port 8728/8729; REST via curl/request… |
| 命令执行 | NONE | NONE | — | pip3 install is the only shell command, declared in Prerequisites section |
| 环境变量 | READ | READ | ✓ 一致 | MIKROTIK_HOST, MIKROTIK_USERNAME, MIKROTIK_PASSWORD — documented as the preferre… |
4 高危 4 项发现
高危 IP 地址 硬编码 IP 地址
1.2.3.4 SKILL.md:424 高危 IP 地址 硬编码 IP 地址
5.6.7.8 SKILL.md:424 高危 IP 地址 硬编码 IP 地址
9.10.11.12 SKILL.md:424 高危 IP 地址 硬编码 IP 地址
8.8.8.8 SKILL.md:451 目录结构
1 文件 · 19.0 KB · 590 行 Markdown 1f · 590L
└─
SKILL.md
Markdown
依赖分析 1 项
| 包名 | 版本 | 来源 | 已知漏洞 | 备注 |
|---|---|---|---|---|
routeros-api | unpinned | pip | 否 | pip install without version pin in SKILL.md example — minor supply-chain concern |
安全亮点
✓ Credentials strongly recommended via environment variables (MIKROTIK_HOST, MIKROTIK_USERNAME, MIKROTIK_PASSWORD), not hardcoded
✓ pip install is declared upfront in Prerequisites
✓ Implements only RouterOS API communication — no arbitrary network requests
✓ No obfuscation, base64, eval, or dynamic code execution patterns
✓ No credential harvesting beyond the explicitly required MikroTik credentials
✓ No scripts or binary files — purely documentation
✓ REST API examples use HTTPS with -k flag only where necessary
✓ Destructive operations (reboot, firewall changes) require user confirmation
✓ Workflow explicitly instructs 'Read first, Confirm destructive ops, then Apply'