스킬 mirrord-kafka

📦

mirrord-kafka

Name: mirrord-kafka
Author: metalbear-co

v2.5 콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어📁 파일 시스템 접근

Configure Kafka Queue Splitting with mirrord

Kafka splitting requires matching Kubernetes resources, client authentication, and developer message filters. This skill guides configuration generation, compatibility checks, and troubleshooting for mirrord.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "mirrord-kafka" from https://skillstore.io/skills/metalbear-co-mirrord-kafka.md and its manifest at https://skillstore.io/api/skills/metalbear-co-mirrord-kafka/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/metalbear-co-mirrord-kafka.md 서명된 manifest GET /api/skills/metalbear-co-mirrord-kafka/manifest 서명된 lockfile GET /api/skills/metalbear-co-mirrord-kafka/lockfile

테스트해 보기

"mirrord-kafka" 사용 중입니다. Our Kafka Streams workload needs splitting and a payload filter.

예상 결과:

Kafka Streams requires the Java client, a Streams application identifier, and the Kafka sidecar.
Payload filtering with jq_filter is unavailable for the Java client.
Use supported header filters and confirm the required operator settings before deployment.

"mirrord-kafka" 사용 중입니다. A non-Streams KafkaJS consumer fails with INCONSISTENT_GROUP_PROTOCOL.

예상 결과:

The documented cause is a custom partition-assignment protocol incompatible with the operator consumer.
For operator 3.195.0 or later, review the temporary consumer-group option.
Confirm rollout completion; operator 3.204.0 or later supports increasing the group-join timeout.

"mirrord-kafka" 사용 중입니다. Our managed Kafka platform rejects temporary topics with PolicyViolation.

예상 결과:

Check the platform minimum replication factor against the temporary-topic configuration.
Operator 3.191.0 or later supports copying the source replication factor or setting an explicit value.
Review the proposed configuration before applying it.

보안 감사

높은 위험

v1 • 2026. 9. 29. 버전별 보고서 열기

Most alerts are false positives involving Markdown backticks, TLS property names, or read-only discovery. Four alerts identify credential exposure through command arguments or unencrypted key exports; unfiltered workload inspection adds a separate disclosure risk. No evidence found of malicious exfiltration or prompt injection.

스캔된 파일

1,165

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (4)

높음

references/known-issues.md:29

Certificate/key files

openssl pkcs12 -in keystore.p12 -nocerts -nodes -out client-key.pem

The -nodes option exports an unencrypted private key to client-key.pem without specifying restrictive permissions. This creates an avoidable credential exposure risk.

높음

references/mirrord-property-list-crd.md:272

Certificate/key files

openssl pkcs12 -in keystore.p12 -nocerts -nodes -out client-key.pem

The command uses -nodes to write an unencrypted private key without restrictive permission guidance. This unnecessarily exposes sensitive key material on disk.

높음

references/mirrord-property-list-crd.md:202

Java keystore files

--from-literal=keystore.jks.base64="$(base64 < keystore.jks | tr -d '\n')" \

The private keystore is expanded into --from-literal, exposing credential-bearing bytes in process arguments. The same example also puts the store password in arguments.

중간

SKILL.md:80-86

Unfiltered Workload Inspection Can Expose Inline Secrets

The workflow requests complete deployment YAML to discover container names and environment variables. Inline passwords or tokens can enter agent context without filtering or redaction.

The command explicitly requests full YAML, including literal environment values. Exposure depends on workload contents, but no output filtering is specified.

기능 검토 항목 (1)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

중간

references/mirrord-property-list-crd.md:202

Shell command substitution

--from-literal=keystore.jks.base64="$(base64 < keystore.jks | tr -d '\n')" \

The substitution puts the private keystore into kubectl command arguments through --from-literal. Process inspection or execution logging can capture this credential-bearing data.

위험 요인

⚙️ 외부 명령어 (50)

📁 파일 시스템 접근 (10)

SKILL.md:60 SKILL.md:63 SKILL.md:64 SKILL.md:67 SKILL.md:68 SKILL.md:71 SKILL.md:72 SKILL.md:75 SKILL.md:82 SKILL.md:83

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/metalbear-co-mirrord-kafka/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/metalbear-co-mirrord-kafka/security.svg)](https://skillstore.io/skills/metalbear-co-mirrord-kafka?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/metalbear-co-mirrord-kafka?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/metalbear-co-mirrord-kafka/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/metalbear-co-mirrord-kafka.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

metalbear-co. (2026). mirrord-kafka security audit report (audit version 1) [Author version 2.5]. Skillstore. https://skillstore.io/skills/metalbear-co-mirrord-kafka/audits/1

BibTeX 인용

@techreport{metalbear-co-metalbear-co-mirrord-kafka-2026,
  author = {metalbear-co},
  title = {mirrord-kafka security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/metalbear-co-mirrord-kafka/audits/1},
  note = {Author version 2.5}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mirrord-kafka security audit report (audit version 1)"
version: "2.5"
type: report
authors:
  - name: "metalbear-co"
date-released: "2026-09-29"
url: "https://skillstore.io/skills/metalbear-co-mirrord-kafka/audits/1"
identifiers:
  - type: other
    value: "skillstore:metalbear-co-mirrord-kafka:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Prepare a Team Kafka Connection

Generate namespace-specific connection and split resources with Secret references and the required Helm settings.

Debug Selected Consumer Messages

Draft header or payload filters that route relevant Kafka messages to a local application.

Diagnose Failed Splitting Sessions

Compare redacted errors and installed versions against documented protocol, replication, and rollout constraints.

이 프롬프트를 사용해 보세요

Check Setup Requirements

Explain the prerequisites for mirrord Kafka splitting. Ask for versions and nonsecret workload details. Do not inspect my cluster or request credentials.

Draft a Standard Consumer Setup

Draft Kafka splitting resources for [deployment] in [namespace], using [broker], [topic environment variable], and [group environment variable]. Reference [Secret name] without reading its values. Include Helm guidance and matching mirrord configuration; do not apply changes.

Design Payload Filters

Design filters for [queue ID] using this redacted payload example: [sample]. Check [operator version], [CLI version], and [client backend]. Explain JSON or raw protobuf options, filter errors, and mirror versus steal behavior.

Review Migration and Failure Recovery

Review these redacted legacy resources and logs: [inputs]. Plan migration to current resources for [versions]. Check namespace lookup, authentication references, replication policies, and rollout timeouts. Provide validation and recovery steps without reading secrets or changing the cluster.

모범 사례

Confirm operator and CLI versions, namespace ownership, and Kafka client compatibility before generating resources.
Use Secret references and owner-only credential files; avoid command-line credential values and unprotected private-key exports.
Review generated changes and redact workload output before sharing it with an agent.

피하기

Pasting passwords, private keys, or unredacted workload YAML into prompts.
Using jq_filter with Kafka Streams or assuming protobuf schema-registry framing is supported.
Setting group.id manually or defining both groupId and appId for one queue.

자주 묻는 질문

Which AI tools can use this skill?

The marketplace lists Claude, Codex, and Claude Code. Cluster inspection also requires an available kubectl installation and appropriate access.

Which mirrord versions support the current resources?

The references require operator 3.170.0 or later and CLI 3.221.0 or later. Individual features require newer versions.

Does Kafka splitting require a paid plan?

The skill identifies Kafka splitting as a Team or Enterprise feature. Confirm licensing before configuring the operator.

Can I filter Kafka messages by their contents?

Yes, jq_filter supports content filtering with librdkafka. It requires operator 3.183.0 or later and CLI 3.232.0 or later.

Should I provide Kafka credentials to the agent?

No. Provide Secret names and property keys only. The audit flags unsafe reference examples that need correction before use.

Can this skill help migrate deprecated resources?

Yes. The references map legacy client and consumer resources to MirrordPropertyList and MirrordSplitConfig, including namespace and authentication changes.