스킬 mirrord-operator

📦

mirrord-operator

Name: mirrord-operator
Author: metalbear-co

v2.14 콘텐츠 리비전 r1 높은 위험 🌐 네트워크 접근⚙️ 외부 명령어📁 파일 시스템 접근🔑 환경 변수

Configure mirrord Operator for Kubernetes Teams

Team deployments require coordinated licensing, Kubernetes permissions, and feature configuration. This skill guides mirrord Operator setup and troubleshooting with Helm references and approval checkpoints.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "mirrord-operator" from https://skillstore.io/skills/metalbear-co-mirrord-operator.md and its manifest at https://skillstore.io/api/skills/metalbear-co-mirrord-operator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/metalbear-co-mirrord-operator.md 서명된 manifest GET /api/skills/metalbear-co-mirrord-operator/manifest 서명된 lockfile GET /api/skills/metalbear-co-mirrord-operator/lockfile

테스트해 보기

"mirrord-operator" 사용 중입니다. Plan a staging installation using an existing cloud API key Secret.

예상 결과:

Authentication: reference the existing Secret under cloud.apiKey.keyRef; its data key must be apiKey.
Access: create chart roles only for required namespaces and review the proposed user bindings.
Deployment: present Helm values and installation commands for approval before execution.
Verification: check operator status and confirm the operator pod is running.

"mirrord-operator" 사용 중입니다. Explain why a rotated cloud API key might not authenticate.

예상 결과:

Confirm that the configured Secret exists in the operator namespace.
Check the Secret data key name and possible trailing newline without displaying the credential.
Review relevant operator errors and confirm connectivity to the licensing service.
Have the user update the Secret securely and approve any required deployment changes.

"mirrord-operator" 사용 중입니다. What must change for an air-gapped deployment?

예상 결과:

Use an Enterprise offline license certificate or a self-hosted license server.
Reference license material through Kubernetes Secrets rather than inline values.
Mirror operator, agent, and enabled feature images into an accessible internal registry.
Review trusted certificates, encrypted transport, and network requirements before installation.

보안 감사

높은 위험

v1 • 2026. 9. 29. 버전별 보고서 열기

Most alerts are false positives from Markdown formatting, YAML comments, and legitimate configuration references. Confirmed risks involve inline credentials, trial response exposure, and HTTP licensing; additional findings address transport security, database authentication, and excessive permissions. No evidence found of prompt injection or malicious intent; cluster changes and trial registration explicitly require user approval.

스캔된 파일

2,000

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (14)

높음

references/helm-values.md:31

Certificate/key files

| `cloud.apiKey.key` | Inline value — plaintext in the pod spec. Dev/test only. |

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

높음

references/helm-values.md:41

Certificate/key files

| `license.key` | Inline license key. Deprecated for cloud; still the shared secret for a self-hoste

The documented license.key option embeds a shared authentication secret in Helm values when followed. This can expose credentials through configuration storage or accidental commits despite safer alternatives.

높음

references/helm-values.md:45

Certificate/key files

| `license.file.secret.data.license.pem` | Inline PEM as a YAML literal block (air-gapped). |

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

높음

references/troubleshooting.md:31

Certificate/key files

- **Cloud API key (default):** the operator exchanges a cloud API key for a license over the API. Pr

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

높음

references/troubleshooting.md:32

Certificate/key files

- **License key (deprecated for cloud):** `license.key` / `license.keyRef` (Secret data key `OPERATO

높음

references/troubleshooting.md:33

Certificate/key files

- **Air-gapped:** offline PEM (`license.file.secret.data.license.pem` or `license.pemRef`) or a `lic

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

높음

SKILL.md:99

Certificate/key files

- **Inline (dev/test only)** — `cloud.apiKey.key: <YOUR_API_KEY>` (lands in the pod spec as plaintex

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

높음

SKILL.md:103

Certificate/key files

**B. License key (deprecated for cloud auth).** Still valid for existing installs and **required** w

확인된 14건 모두 보기

높음

SKILL.md:168

Certificate/key files

license.pem: |

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

높음

SKILL.md:170

Certificate/key files

The inline example places offline license material in Helm values, contrary to the skill's secret-handling boundary. Following it can expose licensing material through shared configuration.

높음

references/values.yaml:826-833

IAM Database Branches Default to Trust Authentication

The reference documents trust authentication for PostgreSQL branches using IAM sources. Clients reaching those branch databases can supply arbitrary credentials, potentially accessing copied application data.

The comments explicitly state that the default accepts any credentials and describe a password alternative. This risk requires IAM-backed branching and network reachability.

중간

references/values.yaml:1365-1367

API Service Certificate Verification Disabled by Default

The supplied defaults set tls.apiService.insecureSkipTLSVerify to true. Deployments retaining this setting cannot authenticate the operator server certificate, allowing impersonation by an attacker controlling the network path.

The active YAML setting explicitly disables verification. The troubleshooting guide recommends verification with a trusted certificate, but installation does not require that override.

중간

references/values.yaml:1212-1214 references/helm-values.md:104

Agent Transport Encryption Disabled by Default

Agent TLS defaults to false, leaving operator-to-agent traffic without this transport protection. Without compensating network encryption, an attacker on the traffic path could observe sensitive session data.

Both references explicitly identify TLS as optional and disabled by default. Actual exposure depends on network controls outside these files.

중간

references/values.yaml:178-181 references/helm-values.md:58

Broad Secret Permissions Enabled by Default

The supplied values enable dbBranchingLiteralCredentials, documented as granting cluster-wide Secret permissions. Unnecessary permissions increase the impact of operator compromise beyond namespaces requiring database branching.

The active default and accompanying documentation identify cluster-wide Secret permissions. Chart templates are not supplied, so exact granted verbs were not verified.

기능 검토 항목 (4)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

SKILL.md:99

Generic API/secret keys

- **Inline (dev/test only)** — `cloud.apiKey.key: <YOUR_API_KEY>` (lands in the pod spec as plaintex

This option places a real cloud API key in plaintext pod configuration when used. The development-only warning reduces exposure but does not prevent credential disclosure.

높음

SKILL.md:152

Generic API/secret keys

This endpoint needs no authentication and no credit card. The response is a provisional organization

The signup response contains an api_key, but the preceding curl command sends its body directly to stdout. Running that example exposes credentials in tool output despite the prose warning.

중간

references/values.yaml:1301

Hardcoded URL

# licenseServer: http://mirrord-operator-license-server.mirrord.svc

The example uses HTTP for a license server authenticated with a shared license key. Without an encrypted network layer, on-path observers can capture that credential.

중간

SKILL.md:179

Hardcoded URL

- **License server** (fully self-hosted) — set `license.licenseServer: http://mirrord-operator-licen

The example uses HTTP for a license server authenticated with a shared license key. Without an encrypted network layer, on-path observers can capture that credential.

위험 요인

🌐 네트워크 접근 (29)

⚙️ 외부 명령어 (50)

📁 파일 시스템 접근 (1)

references/values.yaml:427

🔑 환경 변수 (3)

references/values.yaml:1352 SKILL.md:99 SKILL.md:152

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/metalbear-co-mirrord-operator/security.svg)](https://skillstore.io/skills/metalbear-co-mirrord-operator?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/metalbear-co-mirrord-operator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/metalbear-co-mirrord-operator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/metalbear-co-mirrord-operator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

metalbear-co. (2026). mirrord-operator security audit report (audit version 1) [Author version 2.14]. Skillstore. https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1

BibTeX 인용

@techreport{metalbear-co-metalbear-co-mirrord-operator-2026,
  author = {metalbear-co},
  title = {mirrord-operator security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1},
  note = {Author version 2.14}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mirrord-operator security audit report (audit version 1)"
version: "2.14"
type: report
authors:
  - name: "metalbear-co"
date-released: "2026-09-29"
url: "https://skillstore.io/skills/metalbear-co-mirrord-operator/audits/1"
identifiers:
  - type: other
    value: "skillstore:metalbear-co-mirrord-operator:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Deploy a Team Operator

Prepare a Helm installation with secret references, namespace access, selected features, and post-installation checks.

Diagnose Session Access Failures

Identify operator availability, authentication, RBAC, and feature-flag problems using targeted status and log checks.

Plan an Offline Deployment

Review Enterprise licensing, internal image registries, certificate provisioning, and restricted network requirements before rollout.

이 프롬프트를 사용해 보세요

Check Installation Prerequisites

Explain the prerequisites for installing mirrord Operator in my staging cluster. List required tools, permissions, and licensing without running commands.

Prepare a Helm Installation

Prepare a mirrord Operator installation using an existing Kubernetes Secret for authentication. Show proposed values and commands, then wait for approval before changes.

Troubleshoot Operator Authentication

My mirrord Operator cannot obtain its license after key rotation. Propose read-only checks, avoid displaying secrets, and request approval before corrective changes.

Review Multi-Cluster Deployment Controls

Review a multi-cluster mirrord rollout with preview replicas and PostgreSQL branching. Identify version requirements, RBAC limits, authentication risks, registry dependencies, and approval checkpoints.

모범 사례

Confirm cluster context, namespaces, exact commands, and user approval before every cluster modification.
Use Secret references, protect temporary credential files, and keep API keys out of agent output and committed values.
Enable only required features, restrict access and branch images, and review TLS settings before production deployment.

피하기

Pasting authentication secrets into chat, command arguments, or committed Helm values.
Starting trials or changing shared clusters without explicit user approval.
Enabling preview environments or generic branching without reviewing permissions, image restrictions, and network access.

자주 묻는 질문

Which AI tools can use this skill?

The marketplace lists support for Claude, Codex, and Claude Code.

Does this skill include the mirrord Operator?

No. It provides instructions and reference values. Installation uses the external Helm chart and requires cluster access.

Can I use it without an existing license?

The skill describes a seven-day Enterprise trial with explicit approval. Registration creates an external organization that the user must claim.

Does the trial work in an air-gapped cluster?

No. The documented trial requires telemetry connectivity. Offline deployments use Enterprise license certificates or a self-hosted license server.

Should I give the agent my API key?

No. Create the credential Secret yourself and provide its reference. Keep secret values out of chat, logs, and committed configuration.

Will installation enable every feature?

No. Most advanced features require separate Helm flags and compatible versions. Enable only requested features after reviewing their permissions and security implications.