Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tikoci/routeros-skills --skill routeros-netinstallgit clone --depth 1 https://github.com/tikoci/routeros-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tikoci/routeros-skills/routeros-netinstall)<a href="https://agentmods.dev/skills/tikoci/routeros-skills/routeros-netinstall"><img src="https://agentmods.dev/badge/skills/tikoci/routeros-skills/routeros-netinstall/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tikoci/routeros-skills/routeros-netinstall"><img src="https://agentmods.dev/badge/skills/tikoci/routeros-skills/routeros-netinstall.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.02257 |
| Opus 5 | $0.00041 | $0.01128 |
| Sonnet 5 | $0.00016 | $0.00451 |
| Haiku 4.5 | $0.00008 | $0.00226 |
Grade B, and why
routeros-netinstall scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo ./netinstall-cli -r -i eth0 \ Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
wget https://download.mikrotik.com/routeros/7.22/netinstall-7.22.tar.gz Copies of this mod
1 near-identical copy found in the catalogue:
- routeros-netinstall — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 210 lines — stays where its author put it; the contents beside it link to each section on GitHub.
RouterOS Netinstall
This skill focuses on official Netinstall / netinstall-cli behavior. tikoci/netinstall is a useful wrapper and source of grounded examples, but it is only one way to drive the tool.
What netinstall-cli Does
Netinstall reinstalls RouterOS onto a device that has booted into etherboot mode. The Linux tool, netinstall-cli, listens for BOOTP requests and then sends the RouterOS boot image and selected .npk packages.
Grounded behavior from MikroTik docs:
- Netinstall re-formats the system drive
- It does not erase the RouterOS license key
- It does not reset RouterBOOT settings
- It works over a direct Layer 2 path using BOOTP/DHCP ports and TFTP
- It requires root / sudo
netinstall-cli is the Linux command-line variant. The Windows GUI exposes nearly the same core options.
Command Syntax
netinstall-cli [-r] [-e] [-b] [-m [-o]] [-f] [-v] [-c]
[-k <keyfile>] [-s <userscript>] [-sm <modescript>]
[--mac <mac>] {-i <interface> | -a <client-ip>} [PACKAGES...]
Flags
| Flag | Meaning |
|---|---|
-r |
Reinstall and apply the default-configuration stage |
-e |
Reinstall with empty configuration |
-b |
Discard the currently installed branding package |
-m |
Enable repeated installs in one run |
-o |
With -m, only reinstall a given MAC once per run; by itself it behaves like a normal single install |
-f |
Ignore storage-size checks |
-v |
Verbose output |
-c |
Allow multiple netinstall instances on the same host |
-k <keyfile> |
Install a license key (.KEY) |
-s <userscript> |
Install a persistent configure script that replaces the RouterOS-supplied default configuration script |
-sm <modescript> |
Install a one-time mode script for the first boot after install |
--mac <mac> |
Only respond to this MAC address |
-i <interface> |
Bind to a specific interface |
-a <client-ip> |
Assign a specific client IP; if -i is used, server IP is auto-detected |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 210 lines · 82 tokens per session scan B b7f9f78a4dad
routeros-netinstall is a skill published in the GitHub repository tikoci/routeros-skills (59 stars, last pushed 1mo ago), licensed MIT. It adds 82 tokens to every session and 2,257 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lab-hardware-cad
Design custom laboratory hardware as parametric build123d models and export fabrication-ready STEP, STL, and DXF files - microfluidic chips and molds, optomechanical mounts and breadboard adapters, cuvette and microplate holders, tube racks, animal-behavior rigs, and 3D-printed instrument fixtures. Use when a research…
pylabrobot
Develop and review PyLabRobot lab-automation resources, liquid-handling plans, offline simulations, and supported-device integrations. Use for PyLabRobot protocols or API questions; keep physical execution behind an explicit operator safety gate.
offensive-wifi
Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons…
offensive-z-wave
Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting…
offensive-iot
IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential…
offensive-bluetooth-classic
Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive…