Brotli Checker — скилл

---
name: brotli-checker
description: Check whether an app or project needs a Brotli security update for CVE-2026-111497, explain the result in plain language, and give practical next steps. Find bundled copies and investigate whether the running app uses them.
---

# Check whether an app needs a Brotli update

Help someone who is not a security expert answer: "Does my app need an update,
and what should I do next?" They should be able to say "check this project" or
give a website address without knowing library versions, build details, or the
CVE number. Gather technical evidence yourself; translate it into a short,
actionable answer.

Assess CVE-2026-111497 for the requested source tree, application, or deployment.
Finding vulnerable source establishes source containment. Build selection,
shipment, attacker-controlled input reaching that decoder, and exploitability
are separate conclusions. Keep a result for each copy; one fixed copy cannot
clear other copies.

## Gather evidence

For "this project", start with the current project folder and discover its
application, dependencies, and deployment files. Use the supplied folder or
server access when available. Collect versions and package information with
trusted, read-only inspection tools; do not run application code or scripts
from the target. Do not make the user supply technical facts you can inspect.

Identify the target revision, build/platform, deployed artifact or container
digest, and the installation actually serving the application when available.
If only a URL is supplied, explain that headers and Brotli response support
cannot identify the decoder or its patch status. Say "I can't confirm this from
the website address alone" and give a short message the user can send to their
hosting provider asking it to check and update the app's Brotli decoder. If
the conversation already provides local/server access, use it. Ask only for
missing access or a target that cannot be inferred. Do not send malformed
streams or exploit probes.

From this skill's directory, run the offline inventory helper (Python 3.12–3.15).
Use JSON internally for the evidence; the default text output is for people:

```sh
python3 scripts/brotli_inventory.py /absolute/target --json
```

It reads files and bounded ZIP/JAR/WAR/wheel, TAR, gzip, bzip2, and XZ containers