Auditing Uefi Firmware With Chipsec

What it does

When your agent uses it

• Security work in your project

Example prompts

• “/auditing-uefi-firmware-with-chipsec”

Requirements

• Python 3

Workflow steps

8 steps, taken from the step headings in SKILL.md.

1. 1Run the full automated test suite
2. 2Run the core firmware-protection modules individually
3. 3Verify Secure Boot variable protection
4. 4Inspect SPI flash region access permissions
5. 5Dump SPI flash for offline forensics
6. 6Enumerate and triage UEFI variables
7. 7Limited assessment without a kernel driver
8. 8Triage results and report

What it can do on your machine

Read from SKILL.md and the folder at commit 54a7988. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Python), which the agent can run.

  Shell commands in SKILL.md call:

  • pip
  • git
  • python

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • github.com

  Also links to:

  • chipsec.github.io
  • media.defense.gov

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Auditing Uefi Firmware With Chipsec loads about 2.3k tokens when it runs, and up to ~3.3k if it reads all its reference files. Until then it costs about 62 tokens; SKILL.md has 830 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~62

When it runs · the whole SKILL.md, loaded when a task matches

~2.3k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~3.3k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteRuns commands with sudoSKILL.md:63

  sudo chipsec_main --help

• NoteRuns commands with sudoSKILL.md:64

  sudo chipsec_util --help

• NoteRuns commands with sudoSKILL.md:91

  sudo chipsec_main

• NoteRuns commands with sudoSKILL.md:94

  sudo chipsec_main -j results.json -x results.xml -l chipsec.log

• NoteRuns commands with sudoSKILL.md:102

  sudo chipsec_main -m common

• NoteRuns commands with sudoSKILL.md:105

  sudo chipsec_main -m common.bios_wp

• NoteRuns commands with sudoSKILL.md:108

  sudo chipsec_main -m common.spi_lock

• NoteRuns commands with sudoSKILL.md:111

  sudo chipsec_main -m common.smrr

• NoteRuns commands with sudoSKILL.md:114

  sudo chipsec_main -m common.smm

• NoteRuns commands with sudoSKILL.md:117

  sudo chipsec_main -m common.uefi.s3bootscript

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from mukul975/Anthropic-Cybersecurity-Skills at commit 54a7988, republished under its Apache-2.0 licence (© mukul975). 830 words, ~2,347 tokens.

name

auditing-uefi-firmware-with-chipsec

description

Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.

domain

cybersecurity

subdomain

hardware-firmware-security

tags

hardware-firmware-security, uefi, chipsec, spi-flash, bios-write-protection, secure-boot, firmware-assessment, platform-security

version

1.0

author

mahipal

license

Apache-2.0

nist_csf

ID.AM-02

mitre_attack

T1542.001

# From PyPI
pip install chipsec

# Or from source (builds the kernel helper/driver)
git clone https://github.com/chipsec/chipsec
cd chipsec
python setup.py install        # builds and installs, including the Linux driver

# Verify
sudo chipsec_main --help
sudo chipsec_util --help

sudo chipsec_main

# Save machine-readable output for reporting / diffing
sudo chipsec_main -j results.json -x results.xml -l chipsec.log

# Run the whole common group
sudo chipsec_main -m common

# BIOS write protection: checks BIOS_CNTL BLE/SMM_BWP and SPI protected ranges
sudo chipsec_main -m common.bios_wp

# SPI flash descriptor lock (FLOCKDN) — are flash region accesses locked?
sudo chipsec_main -m common.spi_lock

# SMRR programming — protects SMRAM from cache-based attacks
sudo chipsec_main -m common.smrr

# SMM BIOS write protection
sudo chipsec_main -m common.smm

# S3 resume boot-script protection (against bootscript table attacks)
sudo chipsec_main -m common.uefi.s3bootscript

# Checks that Secure Boot UEFI variables are properly protected
sudo chipsec_main -m common.secureboot.variables

# To actively test write protection of the variables (test hardware ONLY):
sudo chipsec_main -m common.secureboot.variables -a modify

# Report SPI flash regions, descriptor, and access permissions
sudo chipsec_util spi info

# Check the SPI access-control module
sudo chipsec_main -m common.spi_access

# Dump the entire SPI flash to a file
sudo chipsec_util spi dump rom.bin

# Decode the dumped image: extracts firmware volumes, files, NVRAM variables, etc.
sudo chipsec_util decode rom.bin

# List all UEFI variables from the runtime interface
sudo chipsec_util uefi var-list

# List variables directly from the SPI image (offline)
sudo chipsec_util uefi var-find PK
sudo chipsec_util uefi var-read db <GUID> db.bin

# Decode the UEFI firmware structure
sudo chipsec_util uefi decode rom.bin

sudo chipsec_main -n            # --no_driver: skip checks that need the driver
sudo chipsec_main -p <PLATFORM> # force platform code if auto-detect fails

© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 4 other files (scripts, references) in skills/auditing-uefi-firmware-with-chipsec of mukul975/Anthropic-Cybersecurity-Skills.

• SKILL.md
• LICENSE
• references/api-reference.md
• references/standards.md
• scripts/agent.py

Open the folder on GitHubat commit 54a7988