skills/mukul975/anthropic-cybersecurity-skills/hunting-bootkits-in-efi-system-partition/Gen Agent Trust Hub
hunting-bootkits-in-efi-system-partition
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several low-level system utilities (mount, sbverify, yara, efibootmgr, tpm2_pcrread) to inspect firmware and boot components. These actions are performed using subprocess.run with list-based arguments in the provided Python script, which effectively mitigates shell injection risks even when processing potentially malicious file paths found on the ESP.
- [EXTERNAL_DOWNLOADS]: The instructions involve downloading security tools from official package managers (apt, pip) and established GitHub repositories (such as LongSoft/UEFITool). These are recognized resources in the cybersecurity community and align with the skill's forensic purpose.
- [SAFE]: The skill ingests data from the EFI partition, which is inherently untrusted. While a surface for indirect prompt injection exists (filenames or YARA match strings appearing in the agent's context), the implementation is robust against command injection. The risk is minimized by the skill's specific application in threat hunting and the use of safe execution patterns.
Audit Metadata