hunting-bootkits-in-efi-system-partition
costrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skillsBaseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and…
Scores out of 100 · grade A
2026-08-15Works
40% of the score100/100
- Loads cleanly: valid frontmatter, required fields present, no dangling references.
Maintained
25% of the score100/100
- no commits in the last 12 weeks
Adopted
20% of the score24/100
- 52 stars on the source repo.
Documented
15% of the score100/100
- 1,699 words with worked examples.
- Ships 4 bundled files.
Install
npx skills add costrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skills/hunting-bootkits-in-efi-system-partitionWhat it says it does
Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and flagging anomalous non-EFI files or out-of-band bootloader changes. Use during proactive threat hunts for firmware/bootkit persistence (MITRE ATT&CK T1542.003) or when investigating suspected UEFI-level compromise that survives OS reinstall.
Also in costrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skills
| Artifact | Score | What the check found | Type | Reach | Last commit |
|---|---|---|---|---|---|
| abusing-dpapi-for-credential-accesscostrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skills | clean | Skill | 52 stars | 4 days ago | |
| abusing-shadow-credentials-for-privesccostrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skills | clean | Skill | 52 stars | 4 days ago | |
| acquiring-disk-image-with-dd-and-dcflddcostrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skills | clean | Skill | 52 stars | 4 days ago | |
| analyzing-apt-group-with-mitre-navigatorcostrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skills | clean | Skill | 52 stars | 4 days ago | |
| analyzing-browser-forensics-with-hindsightcostrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skills | clean | Skill | 52 stars | 4 days ago | |
| analyzing-disk-image-with-autopsycostrict-plugins-repo/mukul975-anthropic-cybersecurity-skills-cybersecurity-skills | clean | Skill | 52 stars | 4 days ago |
Other security skills
Browse all| Artifact | Score | What the check found | Category | Reach | Last commit |
|---|---|---|---|---|---|
| release-openclaw-ciopenclaw/openclaw | No license | Security | 387k stars | today | |
| site-architecturecoreyhaines31/marketingskills | clean | Security | 94,902 installs | today | |
| cookbook-auditanthropics/claude-cookbooks | clean | Security | 52k stars | 2 days ago | |
| asocoreyhaines31/marketingskills | clean | Security | 46,665 installs | today | |
| openclaw-secret-scanning-maintaineropenclaw/openclaw | No license | Security | 387k stars | today | |
| graph-evolutiontrailofbits/skills | clean | Security | 2,860 installs | today |
Put this measurement in your README
A badge carrying how many listings this index holds from the repository and how many pass every static structural check. It reads from this index every time somebody loads your page, so it changes when the measurement changes and there is nothing to keep up to date. Free, no account, and the value is not something you or we can set by hand.
[](https://skillworks.kynth.studio/?q=costrict-plugins-repo%2Fmukul975-anthropic-cybersecurity-skills-cybersecurity-skills)Would rather not hotlink us? Every badge is also served in shields.io’s endpoint schema, so shields renders the image and your readers never talk to our domain:
Published by Toolproof, the masthead over this index and eight others. The method behind the number is at toolproof.kynth.studio/methodology, and the whole thing is readable as JSON with no key at /api.
