analyzing-uefi-bootkit-persistence

Analyzes UEFI bootkit persistence (SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation) using chipsec for firmware integrity verification, detecting known families like BlackLotus, LoJax, and MoonBounce. Use for UEFI malware analysis, firmware persistence investigation, or Secure Boot bypass detection.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Medium

Suggest reviewing before use

Quality

Content

71%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A thorough, highly actionable forensic workflow with executable commands and useful validation checkpoints. Its main weaknesses are un-signaled bundle files (an api-reference.md and agent.py that are never linked from the body) and some verbosity in the glossary and example report.

Suggestions

Link the existing bundle files from the body — point detailed command listings to references/api-reference.md and mention scripts/agent.py for automated scanning — so progressive disclosure is one level deep rather than duplicated inline.

Trim or move the Key Concepts glossary (UEFI Bootkit, SPI Flash, ESP, Secure Boot, DXE Driver, HVCI) since Claude already knows these terms; keep only the skill-specific distinctions.

Condense the illustrative Output Format example to a compact template with field names and a few annotated [!] markers instead of a full fabricated 70-line report.

Dimension	Reasoning	Score
Conciseness	Mostly efficient with terse executable commands, but the Key Concepts table defines terms Claude already knows (UEFI Bootkit, SPI Flash, Secure Boot, HVCI) and the ~70-line illustrative Output Format report is verbose padding, so some tightening is still possible.	3 / 5
Actionability	Copy-paste-ready commands across every step (e.g. "python chipsec_util.py spi dump firmware_dump.rom", exact Secure Boot GUIDs, "yara -r uefi_bootkits.yar", "bcdedit /enum firmware") with specific examples covering the common cases.	5 / 5
Workflow Clarity	Seven well-sequenced steps with embedded validation (dump integrity hash, BIOS write-protect and SPI lock checks, whitelist comparison) plus a pitfalls-based error-recovery section, though the validate-fix-retry loop is not unified into one explicit feedback cycle.	4 / 5
Progressive Disclosure	Well-organized sections, but the body never references the provided bundle files (references/api-reference.md, scripts/agent.py) and inlines command reference content that duplicates api-reference.md, so content that should be split out is not clearly signaled.	3 / 5
	Total	15 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely states capabilities and explicit use-trigger phrases with named threat families, giving it a clear niche and low conflict risk. Minor room for additional synonyms and file extensions in the trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete analysis actions ("SPI flash implants, ESP modifications, Secure Boot bypass, UEFI variable manipulation", "firmware integrity verification", "detecting known families like BlackLotus, LoJax, and MoonBounce") — comprehensive coverage matching the score-5 anchor.	5 / 5
Completeness	Explicitly answers both what ("Analyzes UEFI bootkit persistence...") and when ("Use for UEFI malware analysis, firmware persistence investigation, or Secure Boot bypass detection") with concrete trigger phrases, matching the score-5 anchor.	5 / 5
Trigger Term Quality	Strong natural terms ("UEFI malware analysis", "firmware persistence investigation", "Secure Boot bypass detection") plus named families and chipsec, but lacks file extensions and a few common synonyms, so it sits just below comprehensive coverage.	4 / 5
Distinctiveness Conflict Risk	A clear UEFI-bootkit niche with named malware families and chipsec gives distinct triggers and minimal conflict risk with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-uefi-bootkit-persistence/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.