Skip to content
Get packs

Guide · Agent skill

How to use the UEFI Bootkit Persistence Analysis agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This page explains how to install and use the analyzing-uefi-bootkit-persistence agent skill, a Claude skill for investigating whether a computer's UEFI startup firmware has been tampered with. It is written for defensive analysts, auditors and students, and assumes you have not used agent skills before. By the end you will know what the skill makes the agent do, how to add it, how to phrase a request, and what you need on hand before running it.

UEFI Bootkit Persistence Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it so you have the analyzing-uefi-bootkit-persistence folder containing SKILL.md, scripts/agent.py and references/api-reference.md.
  2. 2Place the folder in a skills directory. Copy the folder to ~/.claude/skills/ for personal use, or to a project's .claude/skills/ folder to scope it to that project.
  3. 3Or upload the ZIP in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
  4. 4Gather prerequisites. Install or prepare chipsec, UEFITool / UEFIExtract, Python 3.8+, and YARA, and obtain vendor firmware baselines and root or administrator access.
  5. 5Describe the investigation. Ask in plain language, naming the machine, the symptoms and whether you have a firmware dump or only a live system.
  6. 6Review each step's output. Check the findings the agent reports against the vendor baseline and known-good hashes before drawing conclusions.
  7. 7Write up the findings. Request the report structure from Step 7 and include remediation steps for any confirmed issue.

What the skill makes the agent do

An agent skill is a folder containing a SKILL.md file of instructions, plus optional scripts and reference files. When a request matches the skill's description, the agent reads these instructions and follows them. This skill gives the agent a seven-step playbook for checking firmware-level persistence: dumping SPI flash firmware, inspecting UEFI variables and Secure Boot settings, analyzing the EFI System Partition (ESP), scanning firmware for known bootkit signatures, checking Secure Boot bypass indicators, verifying the boot chain, and writing up findings.

The source names detection of known families including BlackLotus, LoJax and MoonBounce, and it lists MITRE ATT&CK mappings T1542.001, T1542.003 and T1553.006. The skill is for defensive analysis. It is not intended for building bootkits.

Install the skill from the ZIP

Download the ZIP for this skill from this page and unzip it. The skill folder contains SKILL.md, scripts/agent.py and references/api-reference.md.

For a personal install, place the unzipped folder in ~/.claude/skills/. To scope it to one project, place it in that project's .claude/skills/ folder instead.

Alternatively, in the Claude apps, upload the ZIP under Settings → Capabilities → Skills.

  • Personal: ~/.claude/skills/analyzing-uefi-bootkit-persistence/
  • Project: .claude/skills/analyzing-uefi-bootkit-persistence/
  • Claude apps: Settings → Capabilities → Skills, then upload the ZIP

Check what you need before you start

The skill assumes specialist tooling. The source lists chipsec (Python) as the core framework, with flashrom as an optional alternative for SPI dumps, UEFITool / UEFIExtract for parsing firmware, Python 3.8+, and Volatility 3 and YARA as optional or supporting tools. You also need vendor firmware baselines for comparison, and root or administrator access. SPI dumps require hardware-level access.

Windows tools such as sigcheck and bcdedit are referenced in the workflow, so some steps only apply on Windows machines. The source recommends a bootable Linux live USB for offline analysis so you avoid running a possibly compromised OS.

  • chipsec framework (Python)
  • flashrom (optional, for SPI dumps)
  • UEFITool / UEFIExtract
  • Python 3.8+
  • Volatility 3 (optional, for memory forensics)
  • YARA with UEFI rule sets
  • Vendor firmware baselines
  • Root or administrator access, and hardware-level access for SPI dumps

Trigger the skill with a natural request

You do not need a special command. Describe the investigation in plain language that mentions UEFI, firmware, Secure Boot or the ESP, and the agent should pick up the skill from its description. Name the machine and what made you suspicious, and say whether you have a firmware dump or only a live system.

Requests that work well describe a concrete situation, for example a machine that reinfects after reinstalling the OS, or Secure Boot showing an unexpected MOK enrollment.

  • "Investigate whether the firmware on this laptop has a UEFI bootkit. Secure Boot shows an unknown MOK enrollment."
  • "Our endpoint re-establishes C2 after we reinstalled Windows. Check the ESP and Secure Boot variables for persistence."
  • "Compare this firmware dump against the vendor baseline and list any added or modified modules."
  • "Audit Secure Boot posture and SPI flash write protection on these workstations against the vendor baseline."

Example workflow: checking the EFI System Partition

The ESP step is one of the most practical parts of the workflow. The skill has the agent mount the ESP, list its files with timestamps, hash every EFI binary, and flag any .efi file outside the standard Microsoft, Boot, ubuntu and grub directories. It also looks for a grubx64.efi file, which the source associates with BlackLotus.

Review the output yourself. A flagged file is a lead to verify, not a confirmed infection.

mkdir /mnt/esp mount /dev/sda1 /mnt/esp find /mnt/esp -name "*.efi" -exec sha256sum {} \;

Safety notes: scripts, network and risky changes

This skill runs scripts. The source lists scripts/agent.py and states that it does not use the network. Read scripts/agent.py before running anything, and confirm you are comfortable with what it executes.

The steps include dumping firmware and reading boot settings. Some listed commands can write to SPI flash, such as the spi write example in the API reference. Writing to firmware or changing boot-related settings can make a system unbootable if done wrongly. Work on a copy of the dump where possible, and do not run write operations during an investigation unless you have a recovery plan.

Only examine machines you are authorized to investigate. Firmware dumping and boot inspection carry legal and policy implications.

  • Read scripts/agent.py before running the skill.
  • Avoid write commands during analysis.
  • Keep a known-good hash and a vendor baseline before you start.
  • Get authorization for the machine first.

Tips for better results

Give the agent the vendor baseline or firmware file early, because the module comparison and whitelist steps depend on it. Tell it the platform and firmware version if you know them, since the report asks for both. If the target is a legacy BIOS/MBR system, say so: the skill states that MBR/VBR bootkits need different methods.

Ask for the report in the structure the skill defines, which covers firmware identification, SPI protection status, Secure Boot configuration, ESP inventory, module comparison, family attribution with confidence, and remediation.

  • Provide the vendor baseline up front.
  • State whether you have a dump or only a live system.
  • Say explicitly if the machine is legacy BIOS.
  • Ask for the findings report template from Step 7.

What people use it for

  • Investigating a machine that re-establishes C2 communication after an OS reinstall or disk replacement.
  • Checking whether Secure Boot has been disabled or shows an unexpected Machine Owner Key enrollment.
  • Comparing a firmware dump against a vendor baseline to list added, modified or removed modules.
  • Auditing firmware write protection and Secure Boot posture across endpoints before hardening.
  • Teaching UEFI malware analysis with chipsec in a lab setting.

Frequently asked questions

How do I install the UEFI Bootkit Persistence Analysis skill?

Download the ZIP from this page and unzip it. Place the analyzing-uefi-bootkit-persistence folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder, or upload the ZIP under Settings → Capabilities → Skills in the Claude apps.

What do I need installed to use this skill?

The source lists chipsec (Python), UEFITool / UEFIExtract, Python 3.8+, YARA with UEFI rule sets, and vendor firmware baselines, plus root or administrator access. Volatility 3 and flashrom are optional. SPI dumps need hardware-level access.

Is the UEFI Bootkit Persistence Analysis skill free?

The source lists the licence as Apache-2.0. Check the repository's licence file for the full terms before using or redistributing it.

Does this skill work on legacy BIOS or MBR bootkits?

No. The skill says standard MBR-based bootkits on legacy BIOS systems without UEFI should use MBR/VBR bootkit analysis instead.

Can this skill damage my computer?

Some steps dump firmware and read boot settings, and the reference file includes a spi write command. Writing firmware or changing boot settings can make a system unbootable if done wrongly, so avoid write operations unless you have a recovery plan.

Which bootkit families does the skill check for?

The description names BlackLotus, LoJax and MoonBounce, and the workflow references CosmicStrand and planted grubx64.efi files tied to BlackLotus. Detection depends on the baseline and tools you provide.

How is this different from running chipsec by itself?

chipsec is the framework the skill drives. The skill adds a structured investigation sequence covering ESP inspection, Secure Boot checks, firmware comparison and a findings report, instead of you choosing each chipsec module yourself.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits incident responders, firmware auditors and students who already have chipsec, UEFITool and vendor baselines and are authorized to examine the machine. It is not a good fit for routine PC troubleshooting or legacy BIOS/MBR systems, where you should pick a different method.

Download the skill