스킬 mirrord-prev-env

📦

mirrord-prev-env

Name: mirrord-prev-env
Author: metalbear-co

v2.5 콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어📁 파일 시스템 접근🌐 네트워크 접근🔑 환경 변수

Create and Manage mirrord Preview Environments

Reviewing service changes in a shared Kubernetes cluster requires careful traffic routing and cleanup. This skill guides mirrord preview configuration, reviewer links, and pull request workflows.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "mirrord-prev-env" from https://skillstore.io/skills/metalbear-co-mirrord-prev-env.md and its manifest at https://skillstore.io/api/skills/metalbear-co-mirrord-prev-env/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/metalbear-co-mirrord-prev-env.md 서명된 manifest GET /api/skills/metalbear-co-mirrord-prev-env/manifest 서명된 lockfile GET /api/skills/metalbear-co-mirrord-prev-env/lockfile

테스트해 보기

"mirrord-prev-env" 사용 중입니다. What should I confirm before starting a staging preview?

예상 결과:

Check the Enterprise license, Operator 3.142.0 or later, CLI 3.189.0 or later, and the enabled preview feature.
Confirm the staging target, cluster context, and trusted image that the target registry credentials can pull.
Choose a unique key, complete-key traffic filter, finite TTL, and explicit teardown step.
Preview log retrieval requires CLI 3.255.0 or later and operator and chart 3.205.0 or later.

"mirrord-prev-env" 사용 중입니다. My preview image fails with ErrImagePull. What should I investigate?

예상 결과:

The preview inherits the target pod specification and image-pull credentials.
Check that the image exists in the registry and repository the target already uses.
A newly created GitHub Container Registry package may be private.
Review pull permissions without exposing registry credentials in logs or workflow files.

"mirrord-prev-env" 사용 중입니다. Can reviewers use a predictable preview URL?

예상 결과:

Stable share hosts can derive a predictable hostname from the environment key.
Enable them only behind ingress authentication because the resulting links are guessable.
Check for sanitized-key collisions and configure DNS, TLS, share-ingress, and finite expiration with the platform team.

보안 감사

높은 위험

v1 • 2026. 9. 29. 버전별 보고서 열기

All 162 static matches are false positives involving Markdown syntax, documentation links, or expected setup operations. Four contextual risks remain: persistent CI credentials, mutable Action references, a missing trusted-PR guard, and traffic filters that match key prefixes. No evidence found of prompt injection, credential exfiltration, or malicious intent in the two reviewed files.

스캔된 파일

573

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (4)

높음

SKILL.md:357-377 SKILL.md:35 SKILL.md:455

Preview Workflow Omits the Required Trusted-PR Gate

The pull_request example starts previews whenever the event is not closed, without checking repository ownership or author approval. Where cluster credentials are available to fork jobs, copying this workflow can deploy untrusted PR images into the shared cluster.

The start condition lacks the trust check explicitly required elsewhere in the skill. Default GitHub fork-secret restrictions mitigate exposure, so exploitation depends on runner credentials and authentication configuration.

중간

SKILL.md:294-323 SKILL.md:325-333

Persistent Cluster Credentials in the Primary CI Example

The setup creates a service-account-token Secret, extracts its token, and stores a reusable kubeconfig in CI. Unlike short-lived authentication, a stolen token remains usable until revoked, extending access to preview-management privileges.

The YAML explicitly creates a persistent service-account-token Secret and instructs storing its derived kubeconfig. OIDC is mentioned, but expiration and rotation are absent from this example.

중간

README.md:45-59 SKILL.md:364-387 SKILL.md:433-446 SKILL.md:64

Mutable Action References in Credentialed CI Workflows

Examples execute metalbear-co/mirrord-preview@main after configuring cluster access. A changed or compromised branch can execute different code with those credentials; the default CLI download adds another unpinned dependency.

The examples use @main rather than immutable revisions and describe automatic installation of the latest CLI. This establishes a supply-chain exposure, not evidence that upstream code is malicious.

중간

SKILL.md:140-145 SKILL.md:375-377 README.md:51-53

Traffic Filters Do Not Enforce Complete Environment Keys

The example regex accepts any suffix after alice-checkout-fix, while CI filters substitute a key without an ending boundary. A longer key sharing that prefix can match another preview filter and misroute requests, weakening the documented session isolation.

The ad-hoc regex explicitly ends its key match with .*, and the CI regex has no complete-member boundary. Prefix collisions follow directly from these documented regex patterns.

위험 요인

⚙️ 외부 명령어 (50)

📁 파일 시스템 접근 (3)

README.md:69 SKILL.md:427 SKILL.md:501

🌐 네트워크 접근 (13)

SKILL.md:34 SKILL.md:52 SKILL.md:66 SKILL.md:120 SKILL.md:175 SKILL.md:234 SKILL.md:286 SKILL.md:497 SKILL.md:498 SKILL.md:499 SKILL.md:500 SKILL.md:501 SKILL.md:502

🔑 환경 변수 (1)

SKILL.md:463

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/metalbear-co-mirrord-prev-env/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/metalbear-co-mirrord-prev-env/security.svg)](https://skillstore.io/skills/metalbear-co-mirrord-prev-env?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/metalbear-co-mirrord-prev-env?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/metalbear-co-mirrord-prev-env/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/metalbear-co-mirrord-prev-env.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

metalbear-co. (2026). mirrord-prev-env security audit report (audit version 1) [Author version 2.5]. Skillstore. https://skillstore.io/skills/metalbear-co-mirrord-prev-env/audits/1

BibTeX 인용

@techreport{metalbear-co-metalbear-co-mirrord-prev-env-2026,
  author = {metalbear-co},
  title = {mirrord-prev-env security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/metalbear-co-mirrord-prev-env/audits/1},
  note = {Author version 2.5}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "mirrord-prev-env security audit report (audit version 1)"
version: "2.5"
type: report
authors:
  - name: "metalbear-co"
date-released: "2026-09-29"
url: "https://skillstore.io/skills/metalbear-co-mirrord-prev-env/audits/1"
identifiers:
  - type: other
    value: "skillstore:metalbear-co-mirrord-prev-env:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Validate a Backend Change

Prepare a staging preview for a built image, route selected requests, inspect failures, and define cleanup.

Standardize Pull Request Previews

Design trusted-PR deployment workflows with scoped authentication, stable session keys, finite expiration, and close-event teardown.

Review Changes Through a Browser

Coordinate authenticated preview links and verify header propagation so reviewers can exercise the intended service version.

이 프롬프트를 사용해 보세요

Check Preview Prerequisites

Help me prepare my first mirrord staging preview. Ask for my operator version, CLI version, license, target, image, and cluster access before suggesting commands.

Configure a Developer Preview

Draft preview configuration for [target] in [namespace] using [image] and key [key]. Include an exact-key traffic filter, finite TTL, validation, logs, and teardown.

Prepare Reviewer Access

Plan authenticated share-ingress access for previews under [domain]. Explain DNS, TLS, header propagation, stable-host tradeoffs, and expiration without installing anything.

Design a Hardened PR Workflow

Draft a mirrord preview workflow for [repository] and [staging target]. Use trusted-PR gates, pinned Actions, verified CLI, short-lived authentication, exact-key filters, finite TTL, concurrency, and close-event cleanup.

모범 사례

Use trusted images on staging targets, complete-key traffic filters, finite TTLs, and explicit teardown.
Gate CI on trusted contributions; pin Actions and use verified CLI binaries with short-lived, least-privilege cluster credentials.
Authenticate reviewer links and test header propagation through every participating service.

피하기

Deploying untrusted PR images into a credentialed shared cluster or targeting production.
Treating routing headers, random hostnames, or shared dependencies as complete security isolation.
Copying mutable Action references, persistent tokens, or prefix-matching filters without review.

자주 묻는 질문

Does this skill include mirrord or a Kubernetes cluster?

No. It provides instructions and examples for existing mirrord tools, an accessible cluster, and a built image.

Which license and versions are required?

Basic previews require Enterprise or a qualifying trial, Operator 3.142.0 or later, and CLI 3.189.0 or later. Advanced features require newer versions.

How does a preview differ from mirrord exec?

A preview deploys a built image in the cluster. mirrord exec connects a local process to the cluster environment.

Can reviewers open previews without adding headers?

Yes, configured share-ingress links inject the routing header. The platform team must provide DNS, TLS, and appropriate access controls.

Can I copy the CI examples directly into production?

No. Use staging and harden trust gates, Action pinning, credential lifetime, traffic filters, and expiration before deployment.

Can previews target CronJobs or workloads with zero replicas?

CronJob previews require Operator 3.205.0 or later and CLI 3.256.0 or later. Zero-replica workload previews support queue-only scenarios, with documented KEDA caveats.