analyzing-bootkit-and-rootkit-samples

Analyzes bootkit and advanced rootkit malware infecting the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware for below-OS persistence, covering boot sector analysis, UEFI module inspection, and anti-rootkit detection. Use when compromise survives OS reinstallation or antivirus/EDR fails to detect malware despite clear infection signs.

Quality

78%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-bootkit-and-rootkit-samples/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-structured forensics workflow with strong executable examples, weakened by padding of concepts Claude already knows, missing feedback loops for destructive operations, and failure to link existing bundle files.

Suggestions

Remove or trim the Key Concepts table and Tools & Systems prose that restate knowledge Claude already has, and condense the multi-paragraph sample Output Format into a short template.

Add explicit validation checkpoints with feedback loops for the destructive steps (e.g., after dd acquisition verify the image hash and retry on mismatch; before any reflash, validate the dump is complete).

Link the existing bundle files from the body (e.g., 'See references/api-reference.md for full dd/ndisasm/chipsec syntax' and 'Run scripts/agent.py for automated MBR parsing') so progressive disclosure is actually signaled.

Dimension	Reasoning	Score
Conciseness	The body is mostly efficient executable code, but the Key Concepts table defines concepts Claude already knows (MBR, UEFI, Secure Boot) and the lengthy sample Output Format report adds padding that could be trimmed.	3 / 5
Actionability	Provides fully executable, copy-paste-ready commands (dd, python3 inline MBR parser, volatility plugins, sigcheck, bcdedit, yara, UEFITool) covering the common bootkit/rootkit analysis cases.	5 / 5
Workflow Clarity	A clear 6-step sequence with some validation (sha256sum integrity, MBR signature checks), but this destructive forensics workflow lacks explicit validate->fix->retry feedback loops, capping it at 3.	3 / 5
Progressive Disclosure	Section structure is good, but the provided bundle files (references/api-reference.md, scripts/agent.py) are never referenced or signaled from the body, and inlinable material (API reference, full sample report) is not split out.	3 / 5
	Total	14 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-crafted description that explicitly states both capability and trigger conditions with concrete, domain-specific language. It is distinctive and uses natural phrasing a security analyst would actually say.

Dimension	Reasoning	Score
Specificity	Names the domain and multiple concrete actions ('boot sector analysis, UEFI module inspection, and anti-rootkit detection') plus the infection targets (MBR/VBR/UEFI), giving comprehensive coverage.	5 / 5
Completeness	Explicitly answers both 'what' (analyzes bootkit/rootkit covering boot sector analysis, UEFI module inspection, anti-rootkit detection) and 'when' ('Use when compromise survives OS reinstallation or antivirus/EDR fails to detect malware...').	5 / 5
Trigger Term Quality	Strong natural triggers ('compromise survives OS reinstallation', 'antivirus/EDR fails to detect malware', MBR/VBR/UEFI) cover the domain well, though a few common synonyms are absent.	4 / 5
Distinctiveness Conflict Risk	Clear niche (below-OS persistence via MBR/VBR/UEFI) with distinctive triggers unlikely to fire for standard user-mode malware skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-bootkit-and-rootkit-samples/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.