Skill
kr2s-was-i-exploited
investigate Rails applications for CVE exploitation
Description
Search a Rails application's Active Storage for evidence that CVE-2026-66066 was exploited against it, establish exactly what any crafted file read, and decide whether that constitutes exfiltration. Requires an exposure window, which kr2s-was-i-vulnerable produces.
SKILL.md
kr2s-was-i-exploited
Open @references/guide.md and follow it. Do not proceed without it.
Determines whether CVE-2026-66066 (GHSA-xr9x-r78c-5hrm) was exploited against a Rails application's Active Storage, and if so, exactly what left the building.
This skill runs second. It cannot start without an exposure window, and
kr2s-was-i-vulnerable is what produces one. If you do not have a start date
and an end date, stop and run that skill first.
It produces a written analysis, not a verdict line. Finding crafted files is the easy half; establishing what they actually read, and whether that amounts to exfiltration or a researcher's harmless proof, is the half that takes judgment.