Compétences mirrord-operator

📦

mirrord-operator

Name: mirrord-operator
Author: metalbear-co

v2.14 Révision du contenu r1 Risque élevé 🌐 Accès réseau⚙️ Commandes externes📁 Accès au système de fichiers🔑 Variables d’environnement

Configure mirrord Operator for Kubernetes Teams

Team deployments require coordinated licensing, Kubernetes permissions, and feature configuration. This skill guides mirrord Operator setup and troubleshooting with Helm references and approval checkpoints.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "mirrord-operator" from https://skillstore.io/skills/metalbear-co-mirrord-operator.md and its manifest at https://skillstore.io/api/skills/metalbear-co-mirrord-operator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/metalbear-co-mirrord-operator.md manifest signé GET /api/skills/metalbear-co-mirrord-operator/manifest lockfile signé GET /api/skills/metalbear-co-mirrord-operator/lockfile

Tester

Utilisation de « mirrord-operator ». Plan a staging installation using an existing cloud API key Secret.

Résultat attendu:

Authentication: reference the existing Secret under cloud.apiKey.keyRef; its data key must be apiKey.
Access: create chart roles only for required namespaces and review the proposed user bindings.
Deployment: present Helm values and installation commands for approval before execution.
Verification: check operator status and confirm the operator pod is running.

Utilisation de « mirrord-operator ». Explain why a rotated cloud API key might not authenticate.

Résultat attendu:

Confirm that the configured Secret exists in the operator namespace.
Check the Secret data key name and possible trailing newline without displaying the credential.
Review relevant operator errors and confirm connectivity to the licensing service.
Have the user update the Secret securely and approve any required deployment changes.

Utilisation de « mirrord-operator ». What must change for an air-gapped deployment?

Résultat attendu:

Use an Enterprise offline license certificate or a self-hosted license server.
Reference license material through Kubernetes Secrets rather than inline values.
Mirror operator, agent, and enabled feature images into an accessible internal registry.
Review trusted certificates, encrypted transport, and network requirements before installation.

Audit de sécurité

Risque élevé

v1 • 29/09/2026 Ouvrir le rapport versionné

Most alerts are false positives from Markdown formatting, YAML comments, and legitimate configuration references. Confirmed risks involve inline credentials, trial response exposure, and HTTP licensing; additional findings address transport security, database authentication, and excessive permissions. No evidence found of prompt injection or malicious intent; cluster changes and trial registration explicitly require user approval.

Fichiers analysés

2,000

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (14)

Élevé

references/helm-values.md:31

Certificate/key files

| `cloud.apiKey.key` | Inline value — plaintext in the pod spec. Dev/test only. |

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

Élevé

references/helm-values.md:41

Certificate/key files

| `license.key` | Inline license key. Deprecated for cloud; still the shared secret for a self-hoste

The documented license.key option embeds a shared authentication secret in Helm values when followed. This can expose credentials through configuration storage or accidental commits despite safer alternatives.

Élevé

references/helm-values.md:45

Certificate/key files

| `license.file.secret.data.license.pem` | Inline PEM as a YAML literal block (air-gapped). |

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

Élevé

references/troubleshooting.md:31

Certificate/key files

- **Cloud API key (default):** the operator exchanges a cloud API key for a license over the API. Pr

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

Élevé

references/troubleshooting.md:32

Certificate/key files

- **License key (deprecated for cloud):** `license.key` / `license.keyRef` (Secret data key `OPERATO

Élevé

references/troubleshooting.md:33

Certificate/key files

- **Air-gapped:** offline PEM (`license.file.secret.data.license.pem` or `license.pemRef`) or a `lic

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

Élevé

SKILL.md:99

Certificate/key files

- **Inline (dev/test only)** — `cloud.apiKey.key: <YOUR_API_KEY>` (lands in the pod spec as plaintex

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

Élevé

SKILL.md:103

Certificate/key files

**B. License key (deprecated for cloud auth).** Still valid for existing installs and **required** w

Afficher les 14 problèmes confirmés

Élevé

SKILL.md:168

Certificate/key files

license.pem: |

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

Élevé

SKILL.md:170

Certificate/key files

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

Élevé

references/values.yaml:826-833

IAM Database Branches Default to Trust Authentication

The reference documents trust authentication for PostgreSQL branches using IAM sources. Clients reaching those branch databases can supply arbitrary credentials, potentially accessing copied application data.

The comments explicitly state that the default accepts any credentials and describe a password alternative. This risk requires IAM-backed branching and network reachability.

Moyen

references/values.yaml:1365-1367

API Service Certificate Verification Disabled by Default

The supplied defaults set tls.apiService.insecureSkipTLSVerify to true. Deployments retaining this setting cannot authenticate the operator server certificate, allowing impersonation by an attacker controlling the network path.

The active YAML setting explicitly disables verification. The troubleshooting guide recommends verification with a trusted certificate, but installation does not require that override.

Moyen

references/values.yaml:1212-1214 references/helm-values.md:104

Agent Transport Encryption Disabled by Default

Agent TLS defaults to false, leaving operator-to-agent traffic without this transport protection. Without compensating network encryption, an attacker on the traffic path could observe sensitive session data.

Both references explicitly identify TLS as optional and disabled by default. Actual exposure depends on network controls outside these files.

Moyen

references/values.yaml:178-181 references/helm-values.md:58

Broad Secret Permissions Enabled by Default

The supplied values enable dbBranchingLiteralCredentials, documented as granting cluster-wide Secret permissions. Unnecessary permissions increase the impact of operator compromise beyond namespaces requiring database branching.

The active default and accompanying documentation identify cluster-wide Secret permissions. Chart templates are not supplied, so exact granted verbs were not verified.

Éléments d’évaluation des capacités (4)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

SKILL.md:99

Generic API/secret keys

- **Inline (dev/test only)** — `cloud.apiKey.key: <YOUR_API_KEY>` (lands in the pod spec as plaintex

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

Élevé

SKILL.md:152

Generic API/secret keys

This endpoint needs no authentication and no credit card. The response is a provisional organization

The signup response contains an api_key, but the preceding curl command sends its body directly to stdout. Running that example exposes credentials in tool output despite the prose warning.

Moyen

references/values.yaml:1301

Hardcoded URL

# licenseServer: http://mirrord-operator-license-server.mirrord.svc

The example uses HTTP for a license server authenticated with a shared license key. Without an encrypted network layer, on-path observers can capture that credential.

Moyen

SKILL.md:179

Hardcoded URL

- **License server** (fully self-hosted) — set `license.licenseServer: http://mirrord-operator-licen

The example uses HTTP for a license server authenticated with a shared license key. Without an encrypted network layer, on-path observers can capture that credential.

Facteurs de risque

🌐 Accès réseau (29)

⚙️ Commandes externes (50)

📁 Accès au système de fichiers (1)

references/values.yaml:427

🔑 Variables d’environnement (3)

references/values.yaml:1352 SKILL.md:99 SKILL.md:152

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/metalbear-co-mirrord-operator/security.svg)](https://skillstore.io/skills/metalbear-co-mirrord-operator?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/metalbear-co-mirrord-operator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/metalbear-co-mirrord-operator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/metalbear-co-mirrord-operator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

metalbear-co. (2026). mirrord-operator security audit report (audit version 1) [Author version 2.14]. Skillstore. https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1

Citation BibTeX

@techreport{metalbear-co-metalbear-co-mirrord-operator-2026,
  author = {metalbear-co},
  title = {mirrord-operator security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1},
  note = {Author version 2.14}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mirrord-operator security audit report (audit version 1)"
version: "2.14"
type: report
authors:
  - name: "metalbear-co"
date-released: "2026-09-29"
url: "https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1"
identifiers:
  - type: other
    value: "skillstore:metalbear-co-mirrord-operator:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Deploy a Team Operator

Prepare a Helm installation with secret references, namespace access, selected features, and post-installation checks.

Diagnose Session Access Failures

Identify operator availability, authentication, RBAC, and feature-flag problems using targeted status and log checks.

Plan an Offline Deployment

Review Enterprise licensing, internal image registries, certificate provisioning, and restricted network requirements before rollout.

Essayez ces prompts

Check Installation Prerequisites

Explain the prerequisites for installing mirrord Operator in my staging cluster. List required tools, permissions, and licensing without running commands.

Prepare a Helm Installation

Prepare a mirrord Operator installation using an existing Kubernetes Secret for authentication. Show proposed values and commands, then wait for approval before changes.

Troubleshoot Operator Authentication

My mirrord Operator cannot obtain its license after key rotation. Propose read-only checks, avoid displaying secrets, and request approval before corrective changes.

Review Multi-Cluster Deployment Controls

Review a multi-cluster mirrord rollout with preview replicas and PostgreSQL branching. Identify version requirements, RBAC limits, authentication risks, registry dependencies, and approval checkpoints.

Bonnes pratiques

Confirm cluster context, namespaces, exact commands, and user approval before every cluster modification.
Use Secret references, protect temporary credential files, and keep API keys out of agent output and committed values.
Enable only required features, restrict access and branch images, and review TLS settings before production deployment.

Éviter

Pasting authentication secrets into chat, command arguments, or committed Helm values.
Starting trials or changing shared clusters without explicit user approval.
Enabling preview environments or generic branching without reviewing permissions, image restrictions, and network access.

Foire aux questions

Which AI tools can use this skill?

The marketplace lists support for Claude, Codex, and Claude Code.

Does this skill include the mirrord Operator?

No. It provides instructions and reference values. Installation uses the external Helm chart and requires cluster access.

Can I use it without an existing license?

The skill describes a seven-day Enterprise trial with explicit approval. Registration creates an external organization that the user must claim.

Does the trial work in an air-gapped cluster?

No. The documented trial requires telemetry connectivity. Offline deployments use Enterprise license certificates or a self-hosted license server.

Should I give the agent my API key?

No. Create the credential Secret yourself and provide its reference. Keep secret values out of chat, logs, and committed configuration.

Will installation enable every feature?

No. Most advanced features require separate Helm flags and compatible versions. Enable only requested features after reviewing their permissions and security implications.