Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tikoci/routeros-skills --skill routeros-webfiggit clone --depth 1 https://github.com/tikoci/routeros-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tikoci/routeros-skills/routeros-webfig)<a href="https://agentmods.dev/skills/tikoci/routeros-skills/routeros-webfig"><img src="https://agentmods.dev/badge/skills/tikoci/routeros-skills/routeros-webfig/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tikoci/routeros-skills/routeros-webfig"><img src="https://agentmods.dev/badge/skills/tikoci/routeros-skills/routeros-webfig.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00104 | $0.02371 |
| Opus 5.5 | $0.00042 | $0.00948 |
| Sonnet 5.5 | $0.00021 | $0.00474 |
| Haiku 4.5 | $0.00010 | $0.00237 |
Grade A, and why
routeros-webfig scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 184 lines — stays where its author put it; the contents beside it link to each section on GitHub.
RouterOS WebFig links and embedded views
Use WebFig to let a human inspect the router's own UI alongside an agent's work. Give them a link plus what to check, for example:
Review the bridge's tagged and untagged VLAN membership: https://router.example/webfig/#Bridge.VLANs
WebFig can edit configuration too; opening its UI does not make an agent's changes approved. Use routeros-centrs for machine configuration and verification. This skill covers navigation and session behavior.[^manual]
Build a link
Use a router web origin reachable from the human's browser or embedded view,
plus /webfig/ and a fragment:
https://router.example:8443/webfig/#IP:Firewall.Connections
https://router.example:8443/webfig/#IP:Addresses
https://router.example:8443/webfig/#Bridge.VLANs
Get the actual service and port from /ip/service through centrs. www serves
HTTP (default 80); www-ssl serves HTTPS (default 443) and needs a valid
certificate. A quickchr host-forward port belongs in the URL instead of the
guest's service port. Prefer trusted HTTPS for deployed routers. A working REST
endpoint proves that the corresponding web service is reachable from that
client. Check the human's browser separately when the agent uses a tunnel or
loopback address on another machine. On releases
exposing /ip/service/webserver, webfig-plain and webfig-secure can disable
WebFig independently of REST. Check /webfig/ and its rendered view too.[^services]
The common grammar is #[group:]service[.container]. Names are
case-sensitive. The served normalize() function replaces whitespace and dots
in service/container names with underscores; it leaves the group literal.
Thus IP → Firewall → Filter Rules is #IP:Firewall.Filter_Rules.
CLI paths are not WebFig fragments: /ip/address maps to #IP:Addresses,
not #ip:address.[^router]
Frequently useful views
These views were opened in Chrome against x86 CHR 7.24.5 and 7.26beta1; see the validation record for versions and limits.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 184 lines · 104 tokens per session scan A 0ad5334475d5
routeros-webfig is a skill published in the GitHub repository tikoci/routeros-skills (77 stars, last pushed today), licensed MIT. It adds 104 tokens to every session and 2,371 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-18.
Other skills, from other repositories
lab-hardware-cad
Designs custom laboratory hardware as parametric build123d models and exports fabrication artifacts as STEP, STL, and DXF files - microfluidic chips and molds, optomechanical mounts and breadboard adapters, cuvette and microplate holders, tube racks, animal-behavior rigs, and 3D-printed instrument fixtures. Use when a…
pylabrobot
Develops and reviews PyLabRobot lab-automation resources, liquid-handling plans, offline simulations, and supported-device integrations. Supports PyLabRobot protocols and API questions; keep physical execution behind an explicit operator safety gate.
pybamm
Simulates lithium-ion battery charge, discharge and rest experiments with PyBaMM, records parameter-set provenance, checks mesh and solver sensitivity, and compares predicted voltage curves with measured cycling data. Use for SPM or DFN electrochemical battery modeling, C-rate protocols, voltage cutoffs, parameter…
offensive-wifi
Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons…
offensive-z-wave
Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting…
offensive-iot
IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential…