Skill
kr2s-was-i-vulnerable
assess Rails application vulnerability to CVEs
Description
Determine whether a Rails application was ever exposed to CVE-2026-66066, and if so produce the exposure window and the other facts a forensic sweep needs. Runs first; kr2s-was-i-exploited consumes its output.
SKILL.md
kr2s-was-i-vulnerable
Open @references/guide.md and follow it. Do not proceed without it.
Determines whether a Rails application was ever exposed to CVE-2026-66066
(GHSA-xr9x-r78c-5hrm), and produces the facts that kr2s-was-i-exploited
requires before it can sweep anything.
The deliverable is a window, not a yes or no. For most applications reading this today the present-tense answer is "no, we patched." The useful answer is the period during which the vulnerable code was serving production traffic, because that is what bounds the search for evidence.
Two things follow, and both are easy to get wrong.
The vulnerable code is gone from HEAD. Analyzing the current tree proves
nothing. You have to check out the tree as it stood before the fix.
The window is bounded by deploy dates, not commit dates. Using the commit date for the end of the window closes it before the fix was actually running, and silently drops any attack in the gap.