analyzing-uefi-bootkit-persistence

Analyzes UEFI bootkit persistence mechanisms including firmware implants in SPI flash, EFI System Partition (ESP) modifications, Secure Boot bypass techniques, and UEFI variable manipulation. Covers detection of known bootkit families (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing. Activates for requests involving UEFI malware analysis, firmware persistence investigation, boot chain integrity verification, or Secure Boot bypass detection.

Quality

77%

Does it follow best practices?

Impact

—

No eval scenarios have been run

Securityby

Advisory

Suggest reviewing before use

Optimize this skill with Tessl

npx tessl skill review --optimize ./skills/analyzing-uefi-bootkit-persistence/SKILL.md

Quality

Discovery

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

This is an excellent skill description that thoroughly covers specific capabilities, includes rich domain-appropriate trigger terms, explicitly states both what the skill does and when it should activate, and occupies a clearly distinct niche. It uses proper third-person voice throughout and avoids vague language or buzzwords. The inclusion of specific tool names (chipsec) and malware family names significantly enhances both trigger quality and distinctiveness.

Dimension	Reasoning	Score
Specificity	Lists multiple specific concrete actions: analyzing firmware implants in SPI flash, ESP modifications, Secure Boot bypass techniques, UEFI variable manipulation, detection of named bootkit families, ESP partition forensic inspection, chipsec-based firmware integrity verification, and Secure Boot configuration auditing.	3 / 3
Completeness	Clearly answers both 'what' (analyzes UEFI bootkit persistence mechanisms, covers detection of known families, ESP forensic inspection, chipsec verification, Secure Boot auditing) and 'when' with explicit triggers ('Activates for requests involving UEFI malware analysis, firmware persistence investigation, boot chain integrity verification, or Secure Boot bypass detection').	3 / 3
Trigger Term Quality	Excellent coverage of natural terms a security analyst would use: 'UEFI', 'bootkit', 'firmware', 'SPI flash', 'ESP', 'Secure Boot', specific malware family names (BlackLotus, LoJax, MosaicRegressor, MoonBounce, CosmicStrand), 'chipsec', 'boot chain integrity', 'firmware persistence'. These are precisely the terms a user investigating UEFI threats would mention.	3 / 3
Distinctiveness Conflict Risk	Highly distinctive niche focused specifically on UEFI/firmware-level threats and boot chain security. The named bootkit families, SPI flash, ESP partition forensics, and chipsec references make this extremely unlikely to conflict with other security or malware analysis skills that operate at higher levels of the stack.	3 / 3
	Total	12 / 12 Passed

Implementation

55%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill excels in actionability with concrete, executable commands and a well-structured multi-step workflow with validation checkpoints. However, it is severely bloated — the Key Concepts table, Tools & Systems section, and extensive output format example add significant token cost while providing information Claude already knows or could infer. The monolithic structure with no progressive disclosure means the entire ~300-line document loads into context every time, wasting tokens on reference material that should be in separate files.

Suggestions

Remove the Key Concepts table entirely — Claude already knows what SPI flash, ESP, Secure Boot, DXE drivers, and UEFI variables are.

Remove the Tools & Systems section since every tool is already demonstrated with concrete commands in the workflow steps.

Move the detailed output format example and the Common Scenarios section into separate referenced files (e.g., OUTPUT_FORMAT.md, SCENARIOS.md) to reduce the main skill's token footprint.

Remove inline bash comments that explain obvious things (e.g., '# Using chipsec to dump SPI flash contents' before a chipsec spi dump command).

Dimension	Reasoning	Score
Conciseness	The skill is extremely verbose at ~250+ lines. The Key Concepts table explains terms like 'SPI Flash', 'ESP', and 'Secure Boot' that Claude already knows. The Tools & Systems section redundantly describes tools already used in the workflow. The detailed output format example, while useful, is excessively long. Many bash comments are unnecessary explanations.	1 / 3
Actionability	The skill provides fully executable commands throughout — chipsec commands, flashrom usage, find/mount/sigcheck commands are all copy-paste ready with specific flags and arguments. The workflow steps contain concrete, specific commands rather than pseudocode or vague instructions.	3 / 3
Workflow Clarity	The 7-step workflow is clearly sequenced from acquisition (SPI dump) through analysis to reporting. Validation checkpoints are present — hash verification after dumping, signature verification of boot components, whitelist comparison for firmware modules, and explicit 'if errors: fix' guidance in the scenario. The scenario section adds a feedback loop with pitfalls to avoid.	3 / 3
Progressive Disclosure	The entire skill is a monolithic wall of text with no references to external files. The Key Concepts table, Tools & Systems section, detailed output format, and scenario could all be split into separate reference files. With no bundle files provided and no external references, all content is inlined regardless of whether it belongs in the main skill file.	1 / 3
	Total	8 / 12 Passed

Validation

90%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 10 / 11 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	10 / 11 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Commit: 0445030

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.