Agent skill · security · aiskillstore
chipsec
Static analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. Decode firmware structure, detect known malware and rootkits (LoJax, ThinkPwn, HackingTeam, MosaicRegressor), generate EFI executable inventories with hashes, extract NVRAM variables, and parse SPI flash descriptors. Use when analyzing firmware .bin/.rom/.fd/.cap files offline without requiring hardware access.
Why this skill is useful
Adds executable scripts for static analysis of UEFI firmware, including malware detection and inventory generation that the AI cannot generate from general knowledge.
What it needs
Requires python installed locally. About 8k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Chipsec - UEFI Firmware Static Analysis You are helping the user perform static security analysis of UEFI/BIOS firmware dumps using Intel's chipsec framework. This skill focuses exclusively on offline analysis capabilities that do not require kernel driver access or root privileges. Tool Overview Chipsec is Intel's Platform Security Assessment Framework. For static analysis of firmware dumps, it provides: EFI executable inventory generation with cryptographic hashes Detection of known UEFI malware and vulnerabilities Firmware structure decoding and extraction NVRAM/UEFI variable extraction SPI flash descriptor parsing Baseline comparison for change detection Prerequisites One-Time Setup (Fix Logging Permission) Chipsec writes into a logs/ directory inside its install location. Create it once. The Python version in the path varies by system, so derive the path instead of hardcoding it: Verify Installation Core Commands All static analysis commands use these flags: -i : Ignore platform check (required for offline analysis) -n : No kernel driver (required for static analysis) 1. Malware and Vulnerability Scan (Primary Use) Scan firmware for known threats including UEFI rootkits and SMM vulnerabilities: Detected Threats: Threat Description Reference -------- ------------- ----------- HTUEFIRootkit HackingTeam commercial UEFI rootkit McAfee ATR MRUEFIRootkit MosaicRegressor APT UEFI implant Kaspersky LoJax First UEFI rootkit found in the wild (Sednit/APT28) ESET ThinkPwn SystemSmmRuntimeRt SMM code execution vulnerability cr4.sh FirmwareBleed SMM Return Stack Buffer stuffing vulnerability Binarly Example Output (Threat Found): 2. Generate EFI Executable Inventory Create a JSON manifest of all EFI modules with cryptographic hashes: Use Cases: Create baseline for change detection Inventory all DXE drivers, PEI modules, applications Generate hashes for threat intelligence lookup Output Format (efilist.json): 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/chipsec