Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tikoci/routeros-skills --skill routeros-mac-telnetgit clone --depth 1 https://github.com/tikoci/routeros-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tikoci/routeros-skills/routeros-mac-telnet)<a href="https://agentmods.dev/skills/tikoci/routeros-skills/routeros-mac-telnet"><img src="https://agentmods.dev/badge/skills/tikoci/routeros-skills/routeros-mac-telnet/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tikoci/routeros-skills/routeros-mac-telnet"><img src="https://agentmods.dev/badge/skills/tikoci/routeros-skills/routeros-mac-telnet.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00141 | $0.06820 |
| Opus 5 | $0.00071 | $0.03410 |
| Sonnet 5 | $0.00028 | $0.01364 |
| Haiku 4.5 | $0.00014 | $0.00682 |
Grade A, and why
routeros-mac-telnet scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- routeros-mac-telnet — 89% identical, 55 lines differ
How it starts
The opening of the file, as written. The whole thing — 461 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MAC-Telnet — MikroTik Layer-2 Terminal Protocol
MAC-Telnet lets you open an interactive RouterOS terminal (or run commands)
addressing a device by its MAC address — you do not need to know or route to
the target's IP. It works across a Layer-2 broadcast domain even when the target
has no IP, a wrong IP, or an IP you cannot route to, which is why WISPs and
provisioning tools rely on it. WinBox's "MAC Telnet" and the tools/mac-telnet
CLI use this protocol family.
Why This Matters for Agents
- It is the only way to get a shell on a freshly-unboxed or misconfigured RouterOS device that has no reachable IP.
- The protocol carries its own 6+6-byte source/destination MAC addressing inside every packet, independent of the outer UDP/L2 delivery. This trips up implementers who assume normal UDP semantics.
- Authentication has two incompatible modes — classic MD5 and modern MTWEI (EC-SRP over Curve25519). Current RouterOS 7.x defaults to MTWEI; getting the mode-detection wrong is the single most common failure.
- It is simple enough to implement from scratch for the MD5 path; MTWEI needs an elliptic-curve library.
Protocol Basics
| Property | Value |
|---|---|
| Transport | UDP |
| Port | 20561 (server listens; client may use an ephemeral or matching source port) |
| Addressing | In-packet 6-byte src + 6-byte dst MAC (the real addressing); outer UDP/IP is just transport |
| Delivery | Layer-2 — broadcast or unicast Ethernet frame to the target MAC; does not cross routers |
| Reliability | Application-level: byte-counter ACKs + timed retransmission (UDP gives none) |
| Session | Stateful handshake → authenticated → raw terminal stream → teardown |
| Auth | MD5 (legacy) or MTWEI / EC-SRP (current RouterOS 7.x default) |
| Max packet | 1500 bytes (MT_PACKET_LEN) |
MAC-Telnet (UDP 20561) is a sibling of MNDP (UDP 5678) from the same
MikroTik L2 toolset: MNDP discovers the device and its MAC; MAC-Telnet then
connects to that MAC. See the routeros-mndp skill for discovery. They are
otherwise independent wire formats — MNDP is a one-shot TLV announcement with no
session, auth, control-block magic, or 00 15 client-type.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 461 lines · 141 tokens per session scan A 24271252584a
routeros-mac-telnet is a skill published in the GitHub repository tikoci/routeros-skills (59 stars, last pushed 1mo ago), licensed MIT. It adds 141 tokens to every session and 6,820 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
autonomous-bug-fix
Reproduces, diagnoses, fixes, and verifies bugs unaided.
debugging
Systematic root-cause investigation for hard bugs.
tia-doctor
Manual, read-only prerequisite probe for TIA Portal V21 and its modular Openness API, with optional Python TIA Scripting and TIA MCP checks.
8051-mcu-debug
Use when debugging 8051-compatible microcontrollers, 51 MCU firmware, STC download issues, Keil C51 projects, interrupts, timers, UART, or startup failures.
cortex-m-debug
Use when debugging Cortex-M microcontrollers, firmware bring-up, SWD/JTAG sessions, faults, startup code, or flashing failures.
firmware-boot-chain
Use when building or debugging a firmware and boot chain (RISC-V SBI, UEFI, ACPI, a bootloader handoff like Limine to an OS) or adding measured boot with a TPM, and a stage fails to hand off to the next.