The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The RouterOS hotspot system facilitates the substitution of user-controlled variables into served HTML/JavaScript content, which constitutes a potential Cross-Site Scripting (XSS) and injection surface.
Ingestion points: Untrusted data enters the agent/system context via variables such as $(http-header-<Name>), $(username), and $(error-orig) as documented in template-variables.md.
Boundary markers: The skill documentation explicitly notes the absence of automatic HTML escaping within the template engine.
Capability inventory: Substituted variables are rendered in client-facing portal pages like login.html, status.html, and error.html.
Sanitization: The skill performs sanitization guidance by directing users to use URL-escaped variants (e.g., $(mac-esc)) and warning against direct interpolation in sensitive HTML contexts without manual escaping.
[SAFE]: The skill implements secure secret management practices by recommending the use of deployment-time template placeholders (e.g., <<radius_secret>>) instead of hardcoding RADIUS shared secrets in scripts.
[SAFE]: The documentation actively prevents common security misconfigurations, such as warning against redundant firewall rules that break HTTPS captive portals and clarifying the correct syntax for DHCP Option 114.

routeros-hotspot