Baseline the EFI System Partition and hunt malicious EFI binaries such as ESPecter, BlackLotus, Bootkitty, and Glupteba by mounting the ESP, hashing and verifying boot loaders, scanning with YARA, and flagging anomalous non-EFI files or out-of-band bootloader changes.
安装
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-bootkits-in-efi-system-partitionnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-bootkits-in-efi-system-partition -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-bootkits-in-efi-system-partition -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/hunting-bootkits-in-efi-system-partitiongh skill install mukul975/Anthropic-Cybersecurity-Skills hunting-bootkits-in-efi-system-partitiongit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-bootkits-in-efi-system-partition ~/.claude/skills/hunting-bootkits-in-efi-system-partition # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-bootkits-in-efi-system-partition ~/.agents/skills/hunting-bootkits-in-efi-system-partition # Codex, Cursor, Gemini CLI, Copilot, OpenCode