Habilidades mirrord-operator

📦

mirrord-operator

Name: mirrord-operator
Author: metalbear-co

v2.14 Revisión del contenido r1 Riesgo alto 🌐 Acceso a red⚙️ Comandos externos📁 Acceso al sistema de archivos🔑 Variables de entorno

Configure mirrord Operator for Kubernetes Teams

Team deployments require coordinated licensing, Kubernetes permissions, and feature configuration. This skill guides mirrord Operator setup and troubleshooting with Helm references and approval checkpoints.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "mirrord-operator" from https://skillstore.io/skills/metalbear-co-mirrord-operator.md and its manifest at https://skillstore.io/api/skills/metalbear-co-mirrord-operator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/metalbear-co-mirrord-operator.md Manifest firmado GET /api/skills/metalbear-co-mirrord-operator/manifest Lockfile firmado GET /api/skills/metalbear-co-mirrord-operator/lockfile

Pruébalo

Usando "mirrord-operator". Plan a staging installation using an existing cloud API key Secret.

Resultado esperado:

Authentication: reference the existing Secret under cloud.apiKey.keyRef; its data key must be apiKey.
Access: create chart roles only for required namespaces and review the proposed user bindings.
Deployment: present Helm values and installation commands for approval before execution.
Verification: check operator status and confirm the operator pod is running.

Usando "mirrord-operator". Explain why a rotated cloud API key might not authenticate.

Resultado esperado:

Confirm that the configured Secret exists in the operator namespace.
Check the Secret data key name and possible trailing newline without displaying the credential.
Review relevant operator errors and confirm connectivity to the licensing service.
Have the user update the Secret securely and approve any required deployment changes.

Usando "mirrord-operator". What must change for an air-gapped deployment?

Resultado esperado:

Use an Enterprise offline license certificate or a self-hosted license server.
Reference license material through Kubernetes Secrets rather than inline values.
Mirror operator, agent, and enabled feature images into an accessible internal registry.
Review trusted certificates, encrypted transport, and network requirements before installation.

Auditoría de seguridad

Riesgo alto

v1 • 29/9/2026 Abrir el informe versionado

Most alerts are false positives from Markdown formatting, YAML comments, and legitimate configuration references. Confirmed risks involve inline credentials, trial response exposure, and HTTP licensing; additional findings address transport security, database authentication, and excessive permissions. No evidence found of prompt injection or malicious intent; cluster changes and trial registration explicitly require user approval.

Archivos escaneados

2,000

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (14)

Alto

references/helm-values.md:31

Certificate/key files

| `cloud.apiKey.key` | Inline value — plaintext in the pod spec. Dev/test only. |

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

Alto

references/helm-values.md:41

Certificate/key files

| `license.key` | Inline license key. Deprecated for cloud; still the shared secret for a self-hoste

The documented license.key option embeds a shared authentication secret in Helm values when followed. This can expose credentials through configuration storage or accidental commits despite safer alternatives.

Alto

references/helm-values.md:45

Certificate/key files

| `license.file.secret.data.license.pem` | Inline PEM as a YAML literal block (air-gapped). |

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

Alto

references/troubleshooting.md:31

Certificate/key files

- **Cloud API key (default):** the operator exchanges a cloud API key for a license over the API. Pr

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

Alto

references/troubleshooting.md:32

Certificate/key files

- **License key (deprecated for cloud):** `license.key` / `license.keyRef` (Secret data key `OPERATO

Alto

references/troubleshooting.md:33

Certificate/key files

- **Air-gapped:** offline PEM (`license.file.secret.data.license.pem` or `license.pemRef`) or a `lic

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

Alto

SKILL.md:99

Certificate/key files

- **Inline (dev/test only)** — `cloud.apiKey.key: <YOUR_API_KEY>` (lands in the pod spec as plaintex

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

Alto

SKILL.md:103

Certificate/key files

**B. License key (deprecated for cloud auth).** Still valid for existing installs and **required** w

Mostrar los 14 problemas confirmados

Alto

SKILL.md:168

Certificate/key files

license.pem: |

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

Alto

SKILL.md:170

Certificate/key files

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

Alto

references/values.yaml:826-833

IAM Database Branches Default to Trust Authentication

The reference documents trust authentication for PostgreSQL branches using IAM sources. Clients reaching those branch databases can supply arbitrary credentials, potentially accessing copied application data.

The comments explicitly state that the default accepts any credentials and describe a password alternative. This risk requires IAM-backed branching and network reachability.

Medio

references/values.yaml:1365-1367

API Service Certificate Verification Disabled by Default

The supplied defaults set tls.apiService.insecureSkipTLSVerify to true. Deployments retaining this setting cannot authenticate the operator server certificate, allowing impersonation by an attacker controlling the network path.

The active YAML setting explicitly disables verification. The troubleshooting guide recommends verification with a trusted certificate, but installation does not require that override.

Medio

references/values.yaml:1212-1214 references/helm-values.md:104

Agent Transport Encryption Disabled by Default

Agent TLS defaults to false, leaving operator-to-agent traffic without this transport protection. Without compensating network encryption, an attacker on the traffic path could observe sensitive session data.

Both references explicitly identify TLS as optional and disabled by default. Actual exposure depends on network controls outside these files.

Medio

references/values.yaml:178-181 references/helm-values.md:58

Broad Secret Permissions Enabled by Default

The supplied values enable dbBranchingLiteralCredentials, documented as granting cluster-wide Secret permissions. Unnecessary permissions increase the impact of operator compromise beyond namespaces requiring database branching.

The active default and accompanying documentation identify cluster-wide Secret permissions. Chart templates are not supplied, so exact granted verbs were not verified.

Elementos de revisión de capacidades (4)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

SKILL.md:99

Generic API/secret keys

- **Inline (dev/test only)** — `cloud.apiKey.key: <YOUR_API_KEY>` (lands in the pod spec as plaintex

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

Alto

SKILL.md:152

Generic API/secret keys

This endpoint needs no authentication and no credit card. The response is a provisional organization

The signup response contains an api_key, but the preceding curl command sends its body directly to stdout. Running that example exposes credentials in tool output despite the prose warning.

Medio

references/values.yaml:1301

Hardcoded URL

# licenseServer: http://mirrord-operator-license-server.mirrord.svc

The example uses HTTP for a license server authenticated with a shared license key. Without an encrypted network layer, on-path observers can capture that credential.

Medio

SKILL.md:179

Hardcoded URL

- **License server** (fully self-hosted) — set `license.licenseServer: http://mirrord-operator-licen

The example uses HTTP for a license server authenticated with a shared license key. Without an encrypted network layer, on-path observers can capture that credential.

Factores de riesgo

🌐 Acceso a red (29)

⚙️ Comandos externos (50)

📁 Acceso al sistema de archivos (1)

references/values.yaml:427

🔑 Variables de entorno (3)

references/values.yaml:1352 SKILL.md:99 SKILL.md:152

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/metalbear-co-mirrord-operator/security.svg)](https://skillstore.io/skills/metalbear-co-mirrord-operator?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/metalbear-co-mirrord-operator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/metalbear-co-mirrord-operator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/metalbear-co-mirrord-operator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

metalbear-co. (2026). mirrord-operator security audit report (audit version 1) [Author version 2.14]. Skillstore. https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1

Cita BibTeX

@techreport{metalbear-co-metalbear-co-mirrord-operator-2026,
  author = {metalbear-co},
  title = {mirrord-operator security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1},
  note = {Author version 2.14}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mirrord-operator security audit report (audit version 1)"
version: "2.14"
type: report
authors:
  - name: "metalbear-co"
date-released: "2026-09-29"
url: "https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1"
identifiers:
  - type: other
    value: "skillstore:metalbear-co-mirrord-operator:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Deploy a Team Operator

Prepare a Helm installation with secret references, namespace access, selected features, and post-installation checks.

Diagnose Session Access Failures

Identify operator availability, authentication, RBAC, and feature-flag problems using targeted status and log checks.

Plan an Offline Deployment

Review Enterprise licensing, internal image registries, certificate provisioning, and restricted network requirements before rollout.

Prueba estos prompts

Check Installation Prerequisites

Explain the prerequisites for installing mirrord Operator in my staging cluster. List required tools, permissions, and licensing without running commands.

Prepare a Helm Installation

Prepare a mirrord Operator installation using an existing Kubernetes Secret for authentication. Show proposed values and commands, then wait for approval before changes.

Troubleshoot Operator Authentication

My mirrord Operator cannot obtain its license after key rotation. Propose read-only checks, avoid displaying secrets, and request approval before corrective changes.

Review Multi-Cluster Deployment Controls

Review a multi-cluster mirrord rollout with preview replicas and PostgreSQL branching. Identify version requirements, RBAC limits, authentication risks, registry dependencies, and approval checkpoints.

Mejores prácticas

Confirm cluster context, namespaces, exact commands, and user approval before every cluster modification.
Use Secret references, protect temporary credential files, and keep API keys out of agent output and committed values.
Enable only required features, restrict access and branch images, and review TLS settings before production deployment.

Evitar

Pasting authentication secrets into chat, command arguments, or committed Helm values.
Starting trials or changing shared clusters without explicit user approval.
Enabling preview environments or generic branching without reviewing permissions, image restrictions, and network access.

Preguntas frecuentes

Which AI tools can use this skill?

The marketplace lists support for Claude, Codex, and Claude Code.

Does this skill include the mirrord Operator?

No. It provides instructions and reference values. Installation uses the external Helm chart and requires cluster access.

Can I use it without an existing license?

The skill describes a seven-day Enterprise trial with explicit approval. Registration creates an external organization that the user must claim.

Does the trial work in an air-gapped cluster?

No. The documented trial requires telemetry connectivity. Offline deployments use Enterprise license certificates or a self-hosted license server.

Should I give the agent my API key?

No. Create the credential Secret yourself and provide its reference. Keep secret values out of chat, logs, and committed configuration.

Will installation enable every feature?

No. Most advanced features require separate Helm flags and compatible versions. Enable only requested features after reviewing their permissions and security implications.