Skills routeros-mndp
📦
routeros-mndp
Content revision r1 Medium Risk ⚙️ External commands🌐 Network access
Discover RouterOS Neighbors with MNDP
RouterOS discovery is hard to implement when MNDP packet behavior is unclear. This skill explains the wire format, neighbor commands, parsing details, and safety constraints.
Supports: Claude Codex Code(CC)
This skill is part of a pack
Install the whole pack to get every skill the task needs, in one command.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "routeros-mndp" from https://skillstore.io/skills/tikoci-routeros-mndp.md and its manifest at https://skillstore.io/api/skills/tikoci-routeros-mndp/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "routeros-mndp". Why does the same router appear several times in neighbor discovery?
Expected outcome:
- The router sends one announcement per active interface.
- Each announcement can have a different MAC address, interface name, and IP address.
- Group results by identity, then use MAC and interface details to disambiguate entries.
Using "routeros-mndp". Plan a safe MNDP scan for an office LAN.
Expected outcome:
- Confirm authorization for the target VLAN before sending discovery traffic.
- Use a listen window long enough for delayed replies and repeated refresh packets.
- Treat identity, version, board, IP, MAC, and uptime as sensitive inventory data.
Using "routeros-mndp". What should I check when WinBox does not show a router?
Expected outcome:
- Check that the device is on the same broadcast domain or reachable overlay.
- Review neighbor discovery settings and interface lists on RouterOS.
- Increase the scan timeout before concluding the device is offline.
Security Audit
Medium Riskv5 • 7/7/2026 Open versioned report
Most static findings are false positives caused by Markdown code fences, inline RouterOS paths, and protocol constants. One low-risk reconnaissance concern is valid because MNDP exposes device inventory metadata, and one semantic issue flags an insecure HTTP Basic Auth REST example. No prompt injection, malware behavior, persistence, or data exfiltration intent was found.
1
Files scanned
267
Lines analyzed
0
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Insecure REST Example Uses Plain HTTP
The REST API example uses `curl -u admin:` over `http://<router-ip>/rest/ip/neighbor`, which can normalize plaintext Basic Auth and a default admin account in copied examples.
The exact example combines HTTP Basic Auth, a placeholder router host, and the admin user with an empty password field. This is actionable sample text, although it appears in documentation rather than executable code.
Low
System reconnaissance
- MNDP reveals: identity (hostname), version, board model, IPs, MACs, uptime
The line explicitly lists hostnames, versions, board models, IPs, MACs, and uptime as data MNDP reveals. That inventory can aid local network reconnaissance, even though the skill presents it as a security consideration.
Risk Factors
⚙️ External commands (38)
SKILL.md:14 SKILL.md:42-49 SKILL.md:49-51 SKILL.md:51-55 SKILL.md:55-60 SKILL.md:60-66 SKILL.md:66-71 SKILL.md:71-81 SKILL.md:81 SKILL.md:82-83 SKILL.md:83 SKILL.md:89-102 SKILL.md:102-119 SKILL.md:119-121 SKILL.md:121-126 SKILL.md:126-132 SKILL.md:132-145 SKILL.md:145-149 SKILL.md:149-154 SKILL.md:154-168 SKILL.md:168-170 SKILL.md:170-177 SKILL.md:177-179 SKILL.md:179-185 SKILL.md:185-187 SKILL.md:187 SKILL.md:195-197 SKILL.md:197-199 SKILL.md:199-201 SKILL.md:201-205 SKILL.md:205-239 SKILL.md:239-246 SKILL.md:246-259 SKILL.md:259-260 SKILL.md:260 SKILL.md:261-262 SKILL.md:262-266 SKILL.md:266
🌐 Network access (5)
Detected Patterns
System reconnaissance
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/tikoci-routeros-mndp/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/tikoci-routeros-mndp?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/tikoci-routeros-mndp?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tikoci-routeros-mndp/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/tikoci-routeros-mndp.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
tikoci. (2026). routeros-mndp security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/tikoci-routeros-mndp/audits/5BibTeX citation
@techreport{tikoci-tikoci-routeros-mndp-2026,
author = {tikoci},
title = {routeros-mndp security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/tikoci-routeros-mndp/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "routeros-mndp security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "tikoci"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/tikoci-routeros-mndp/audits/5"
identifiers:
- type: other
value: "skillstore:tikoci-routeros-mndp:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Implement Local Discovery
Build a tool that discovers MikroTik devices on an authorized local network and groups duplicate interface announcements.
Troubleshoot Missing Neighbors
Diagnose why RouterOS devices do not appear in WinBox or /ip/neighbor results during maintenance.
Harden Discovery Exposure
Review what MNDP exposes and restrict discovery on guest, public, or untrusted interfaces.
Try These Prompts
Explain MNDP Discovery
Explain how MNDP discovers MikroTik routers on a local network. Focus on packet flow, returned fields, and security limits.
Interpret Neighbor Data
Show me how to interpret RouterOS /ip/neighbor output. Explain identity, interface, address, version, platform, and board fields.
Design a Listener
Help me design an MNDP listener for my authorized lab network. Include refresh timing, socket options, duplicate grouping, and timeout handling.
Review Parser Logic
Review my MNDP parser design for TLV handling, byte order, malformed packets, IPv6 zone identifiers, and duplicate interface announcements.
Best Practices
- Use MNDP only on networks you own or are authorized to administer.
- Group multi-interface announcements by identity, then verify with MAC and interface names.
- Disable or restrict discovery on public, guest, and other untrusted interfaces.
Avoid
- Do not treat missing MNDP replies as proof that a router is offline.
- Do not expose MNDP on untrusted network segments.
- Do not copy REST examples with default admin credentials or plaintext transport.
Frequently Asked Questions
Does this skill run network scans?
No. It provides protocol guidance and examples. Any scan must be initiated by the user in an authorized environment.
What network scope does MNDP cover?
MNDP normally works inside one Layer 2 broadcast domain. Routers do not forward standard IPv4 broadcasts.
Does MNDP require authentication?
No. MNDP has no built-in authentication, so restrict discovery on untrusted interfaces.
Can this help parse MNDP packets?
Yes. It explains TLV records, byte order, core field types, and malformed packet handling.
Does it cover RouterOS REST access?
Yes. It references neighbor data through REST, but users should prefer secure transport and non-default accounts.
Which AI tools can use this skill?
Claude, Codex, and Claude Code can use the skill content.