kr2s-was-i-exploited

Open @references/guide.md and follow it. Do not proceed without it.

Determines whether CVE-2026-66066 (GHSA-xr9x-r78c-5hrm) was exploited against a Rails application's Active Storage, and if so, exactly what left the building.

This skill runs second. It cannot start without an exposure window, and kr2s-was-i-vulnerable is what produces one. If you do not have a start date and an end date, stop and run that skill first.

It produces a written analysis, not a verdict line. Finding crafted files is the easy half; establishing what they actually read, and whether that amounts to exfiltration or a researcher's harmless proof, is the half that takes judgment.