スキル mirrord-operator

📦

mirrord-operator

Name: mirrord-operator
Author: metalbear-co

v2.14 コンテンツリビジョン r1 高リスク 🌐 ネットワークアクセス⚙️ 外部コマンド📁 ファイルシステムへのアクセス🔑 環境変数

Configure mirrord Operator for Kubernetes Teams

Team deployments require coordinated licensing, Kubernetes permissions, and feature configuration. This skill guides mirrord Operator setup and troubleshooting with Helm references and approval checkpoints.

対応: Claude Codex Code(CC)

⚠️ 38 不十分

Maintain this Skill? Claim it ⚠️ 38 不十分

インストール前に停止して確認を求めてください。

計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "mirrord-operator" from https://skillstore.io/skills/metalbear-co-mirrord-operator.md and its manifest at https://skillstore.io/api/skills/metalbear-co-mirrord-operator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/metalbear-co-mirrord-operator.md 署名済み manifest GET /api/skills/metalbear-co-mirrord-operator/manifest 署名済み lockfile GET /api/skills/metalbear-co-mirrord-operator/lockfile

テストする

「mirrord-operator」を使用しています。 Plan a staging installation using an existing cloud API key Secret.

期待される結果:

Authentication: reference the existing Secret under cloud.apiKey.keyRef; its data key must be apiKey.
Access: create chart roles only for required namespaces and review the proposed user bindings.
Deployment: present Helm values and installation commands for approval before execution.
Verification: check operator status and confirm the operator pod is running.

「mirrord-operator」を使用しています。 Explain why a rotated cloud API key might not authenticate.

期待される結果:

Confirm that the configured Secret exists in the operator namespace.
Check the Secret data key name and possible trailing newline without displaying the credential.
Review relevant operator errors and confirm connectivity to the licensing service.
Have the user update the Secret securely and approve any required deployment changes.

「mirrord-operator」を使用しています。 What must change for an air-gapped deployment?

期待される結果:

Use an Enterprise offline license certificate or a self-hosted license server.
Reference license material through Kubernetes Secrets rather than inline values.
Mirror operator, agent, and enabled feature images into an accessible internal registry.
Review trusted certificates, encrypted transport, and network requirements before installation.

セキュリティ監査

高リスク

v1 • 2026/9/29 バージョン別レポートを開く

Most alerts are false positives from Markdown formatting, YAML comments, and legitimate configuration references. Confirmed risks involve inline credentials, trial response exposure, and HTTP licensing; additional findings address transport security, database authentication, and excessive permissions. No evidence found of prompt injection or malicious intent; cluster changes and trial registration explicitly require user approval.

スキャンされたファイル

2,000

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (14)

高

references/helm-values.md:31

Certificate/key files

| `cloud.apiKey.key` | Inline value — plaintext in the pod spec. Dev/test only. |

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

高

references/helm-values.md:41

Certificate/key files

| `license.key` | Inline license key. Deprecated for cloud; still the shared secret for a self-hoste

The documented license.key option embeds a shared authentication secret in Helm values when followed. This can expose credentials through configuration storage or accidental commits despite safer alternatives.

高

references/helm-values.md:45

Certificate/key files

| `license.file.secret.data.license.pem` | Inline PEM as a YAML literal block (air-gapped). |

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

高

references/troubleshooting.md:31

Certificate/key files

- **Cloud API key (default):** the operator exchanges a cloud API key for a license over the API. Pr

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

高

references/troubleshooting.md:32

Certificate/key files

- **License key (deprecated for cloud):** `license.key` / `license.keyRef` (Secret data key `OPERATO

高

references/troubleshooting.md:33

Certificate/key files

- **Air-gapped:** offline PEM (`license.file.secret.data.license.pem` or `license.pemRef`) or a `lic

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

高

SKILL.md:99

Certificate/key files

- **Inline (dev/test only)** — `cloud.apiKey.key: <YOUR_API_KEY>` (lands in the pod spec as plaintex

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

高

SKILL.md:103

Certificate/key files

**B. License key (deprecated for cloud auth).** Still valid for existing installs and **required** w

確認済みの14件をすべて表示

高

SKILL.md:168

Certificate/key files

license.pem: |

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

高

SKILL.md:170

Certificate/key files

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

高

references/values.yaml:826-833

IAM Database Branches Default to Trust Authentication

The reference documents trust authentication for PostgreSQL branches using IAM sources. Clients reaching those branch databases can supply arbitrary credentials, potentially accessing copied application data.

The comments explicitly state that the default accepts any credentials and describe a password alternative. This risk requires IAM-backed branching and network reachability.

中

references/values.yaml:1365-1367

API Service Certificate Verification Disabled by Default

The supplied defaults set tls.apiService.insecureSkipTLSVerify to true. Deployments retaining this setting cannot authenticate the operator server certificate, allowing impersonation by an attacker controlling the network path.

The active YAML setting explicitly disables verification. The troubleshooting guide recommends verification with a trusted certificate, but installation does not require that override.

中

references/values.yaml:1212-1214 references/helm-values.md:104

Agent Transport Encryption Disabled by Default

Agent TLS defaults to false, leaving operator-to-agent traffic without this transport protection. Without compensating network encryption, an attacker on the traffic path could observe sensitive session data.

Both references explicitly identify TLS as optional and disabled by default. Actual exposure depends on network controls outside these files.

中

references/values.yaml:178-181 references/helm-values.md:58

Broad Secret Permissions Enabled by Default

The supplied values enable dbBranchingLiteralCredentials, documented as granting cluster-wide Secret permissions. Unnecessary permissions increase the impact of operator compromise beyond namespaces requiring database branching.

The active default and accompanying documentation identify cluster-wide Secret permissions. Chart templates are not supplied, so exact granted verbs were not verified.

機能レビュー項目 (4)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高

SKILL.md:99

Generic API/secret keys

- **Inline (dev/test only)** — `cloud.apiKey.key: <YOUR_API_KEY>` (lands in the pod spec as plaintex

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

高

SKILL.md:152

Generic API/secret keys

This endpoint needs no authentication and no credit card. The response is a provisional organization

The signup response contains an api_key, but the preceding curl command sends its body directly to stdout. Running that example exposes credentials in tool output despite the prose warning.

中

references/values.yaml:1301

Hardcoded URL

# licenseServer: http://mirrord-operator-license-server.mirrord.svc

The example uses HTTP for a license server authenticated with a shared license key. Without an encrypted network layer, on-path observers can capture that credential.

中

SKILL.md:179

Hardcoded URL

- **License server** (fully self-hosted) — set `license.licenseServer: http://mirrord-operator-licen

The example uses HTTP for a license server authenticated with a shared license key. Without an encrypted network layer, on-path observers can capture that credential.

リスク要因

🌐 ネットワークアクセス (29)

⚙️ 外部コマンド (50)

📁 ファイルシステムへのアクセス (1)

references/values.yaml:427

🔑 環境変数 (3)

references/values.yaml:1352 SKILL.md:99 SKILL.md:152

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/metalbear-co-mirrord-operator/security.svg)](https://skillstore.io/skills/metalbear-co-mirrord-operator?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/metalbear-co-mirrord-operator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/metalbear-co-mirrord-operator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/metalbear-co-mirrord-operator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

metalbear-co. (2026). mirrord-operator security audit report (audit version 1) [Author version 2.14]. Skillstore. https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1

BibTeX形式の引用

@techreport{metalbear-co-metalbear-co-mirrord-operator-2026,
  author = {metalbear-co},
  title = {mirrord-operator security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1},
  note = {Author version 2.14}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mirrord-operator security audit report (audit version 1)"
version: "2.14"
type: report
authors:
  - name: "metalbear-co"
date-released: "2026-09-29"
url: "https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1"
identifiers:
  - type: other
    value: "skillstore:metalbear-co-mirrord-operator:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Deploy a Team Operator

Prepare a Helm installation with secret references, namespace access, selected features, and post-installation checks.

Diagnose Session Access Failures

Identify operator availability, authentication, RBAC, and feature-flag problems using targeted status and log checks.

Plan an Offline Deployment

Review Enterprise licensing, internal image registries, certificate provisioning, and restricted network requirements before rollout.

これらのプロンプトを試す

Check Installation Prerequisites

Explain the prerequisites for installing mirrord Operator in my staging cluster. List required tools, permissions, and licensing without running commands.

Prepare a Helm Installation

Prepare a mirrord Operator installation using an existing Kubernetes Secret for authentication. Show proposed values and commands, then wait for approval before changes.

Troubleshoot Operator Authentication

My mirrord Operator cannot obtain its license after key rotation. Propose read-only checks, avoid displaying secrets, and request approval before corrective changes.

Review Multi-Cluster Deployment Controls

Review a multi-cluster mirrord rollout with preview replicas and PostgreSQL branching. Identify version requirements, RBAC limits, authentication risks, registry dependencies, and approval checkpoints.

ベストプラクティス

Confirm cluster context, namespaces, exact commands, and user approval before every cluster modification.
Use Secret references, protect temporary credential files, and keep API keys out of agent output and committed values.
Enable only required features, restrict access and branch images, and review TLS settings before production deployment.

回避

Pasting authentication secrets into chat, command arguments, or committed Helm values.
Starting trials or changing shared clusters without explicit user approval.
Enabling preview environments or generic branching without reviewing permissions, image restrictions, and network access.

よくある質問

Which AI tools can use this skill?

The marketplace lists support for Claude, Codex, and Claude Code.

Does this skill include the mirrord Operator?

No. It provides instructions and reference values. Installation uses the external Helm chart and requires cluster access.

Can I use it without an existing license?

The skill describes a seven-day Enterprise trial with explicit approval. Registration creates an external organization that the user must claim.

Does the trial work in an air-gapped cluster?

No. The documented trial requires telemetry connectivity. Offline deployments use Enterprise license certificates or a self-hosted license server.

Should I give the agent my API key?

No. Create the credential Secret yourself and provide its reference. Keep secret values out of chat, logs, and committed configuration.

Will installation enable every feature?

No. Most advanced features require separate Helm flags and compatible versions. Enable only requested features after reviewing their permissions and security implications.