Skills chipsec
📦
chipsec
Content revision r2 High Risk ⚙️ External commands📁 Filesystem access
Analyze UEFI Firmware with CHIPSEC
Firmware dumps are difficult to inspect consistently, and missed changes can hide persistent threats. This skill provides repeatable offline CHIPSEC workflows for scanning, inventory, decoding, and comparison.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "chipsec" from https://skillstore.io/skills/brownfinesecurity-chipsec.md and its manifest at https://skillstore.io/api/skills/brownfinesecurity-chipsec/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "chipsec". Assess firmware.bin for known UEFI threats.
Expected outcome:
- Format check: the image appears suitable for CHIPSEC offline parsing.
- Threat scan: no blocked EFI signature match was reported.
- Assessment: this result does not exclude unknown threats; create an inventory and review parser warnings.
Using "chipsec". Compare firmware_updated.bin with the approved baseline.
Expected outcome:
- Comparison summary: two EFI modules changed and one module was added.
- Evidence: record each affected GUID and old and new hashes in the case notes.
- Next step: validate the changes against the vendor update manifest before approval.
Using "chipsec". Decode the firmware and inspect available NVRAM data.
Expected outcome:
- Decode summary: firmware volumes and EFI sections were extracted to a separate analysis directory.
- NVRAM summary: variable listings were present, but sensitive values require controlled handling.
- Caution: preserve the original image and review all parser errors before drawing conclusions.
Security Audit
High Riskv9 • 7/23/2026 Open versioned report
Most detections are false positives caused by Markdown syntax, defensive malware terminology, and documented offline diagnostic commands. Six findings are confirmed in duplicated setup guidance that invokes sudo on a derived path and makes CHIPSEC log directories world-writable. No prompt injection, data exfiltration intent, or malware-enabling behavior was found.
1
Files scanned
536
Lines analyzed
4
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Overly permissive chmod
sudo chmod 777 "$CHIPSEC_DIR/logs"
The setup explicitly applies sudo chmod 777 to a CHIPSEC logs directory. World-writable permissions allow any local user to replace files or manipulate paths used by later analysis.
High
Overly permissive chmod
sudo chmod 777 "$CHIPSEC_DIR/logs"
The setup explicitly applies sudo chmod 777 to a CHIPSEC logs directory. World-writable permissions allow any local user to replace files or manipulate paths used by later analysis.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo mkdir -p "$CHIPSEC_DIR/logs"
The setup derives CHIPSEC_DIR from locations including the user-controlled ~/.local tree and does not reject an empty result before invoking sudo. Root can therefore create a directory at an unintended or untrusted path.
High
sudo privilege escalation
sudo chmod 777 "$CHIPSEC_DIR/logs"
The command deliberately uses sudo to apply mode 777 to a derived package path. This grants every local user write access and can expose privileged CHIPSEC activity to file or symlink manipulation.
High
sudo privilege escalation
sudo mkdir -p "$CHIPSEC_DIR/logs"
The setup derives CHIPSEC_DIR from locations including the user-controlled ~/.local tree and does not reject an empty result before invoking sudo. Root can therefore create a directory at an unintended or untrusted path.
High
sudo privilege escalation
sudo chmod 777 "$CHIPSEC_DIR/logs"
The command deliberately uses sudo to apply mode 777 to a derived package path. This grants every local user write access and can expose privileged CHIPSEC activity to file or symlink manipulation.
Risk Factors
⚙️ External commands (50)
SKILL.md:25 SKILL.md:27-31 SKILL.md:31-35 SKILL.md:35-37 SKILL.md:37-42 SKILL.md:42-43 SKILL.md:43-49 SKILL.md:49-51 SKILL.md:51-64 SKILL.md:64-72 SKILL.md:72-78 SKILL.md:78-80 SKILL.md:80-88 SKILL.md:88-97 SKILL.md:97-103 SKILL.md:103-105 SKILL.md:105-116 SKILL.md:116-118 SKILL.md:118-121 SKILL.md:121-127 SKILL.md:127-131 SKILL.md:131-133 SKILL.md:133-135 SKILL.md:135-138 SKILL.md:138-143 SKILL.md:143-146 SKILL.md:146-148 SKILL.md:148-150 SKILL.md:150 SKILL.md:156-158 SKILL.md:158-185 SKILL.md:185-186 SKILL.md:186-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189-190 SKILL.md:190-191 SKILL.md:191-199 SKILL.md:199-222 SKILL.md:222-228 SKILL.md:228-238 SKILL.md:238-244 SKILL.md:244-256 SKILL.md:256-262 SKILL.md:262-286 SKILL.md:286-292 SKILL.md:292-307 SKILL.md:307-331 SKILL.md:331-333 SKILL.md:333-341
📁 Filesystem access (10)
Detected Patterns
Overly permissive chmod×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/brownfinesecurity-chipsec/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/brownfinesecurity-chipsec?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/brownfinesecurity-chipsec?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brownfinesecurity-chipsec/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/brownfinesecurity-chipsec.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
BrownFineSecurity. (2026). chipsec security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brownfinesecurity-chipsec/audits/9BibTeX citation
@techreport{brownfinesecurity-brownfinesecurity-chipsec-2026,
author = {BrownFineSecurity},
title = {chipsec security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/brownfinesecurity-chipsec/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "chipsec security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "BrownFineSecurity"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/brownfinesecurity-chipsec/audits/9"
identifiers:
- type: other
value: "skillstore:brownfinesecurity-chipsec:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
73
Community
78
Spec Compliance
What You Can Build
Triage a firmware dump
Scan an authorized image for known blocked EFI modules and summarize evidence for further investigation.
Compare incident evidence
Build inventories from suspect and known-good images, then identify changed EFI modules and hashes.
Document device firmware
Decode firmware structure, inventory modules, and extract available NVRAM information for an embedded device assessment.
Try These Prompts
Run a basic threat scan
I am authorized to analyze [firmware path]. Verify its format, run the offline CHIPSEC blocked-image scan, and summarize matches, errors, and next steps.
Create a firmware inventory
Generate an EFI inventory for [firmware path]. Report module names, GUIDs, hashes, inventory location, and any parsing failures without modifying the source image.
Compare an update with a baseline
Compare [updated firmware] against [baseline inventory]. Group added, removed, and changed EFI modules, then flag differences that need manual security review.
Conduct a complete offline assessment
Assess [firmware path] using threat scanning, EFI inventory, structure decoding, and NVRAM extraction. Include SPI descriptor analysis only when [platform code] is valid. Preserve evidence, record tool errors, and separate confirmed findings from uncertain indicators.
Best Practices
- Analyze only firmware you own or have explicit authorization to inspect.
- Preserve the original image, record its hash, and perform parsing in an isolated workspace.
- Validate every input and output path, and use user-owned directories with restrictive permissions.
Avoid
- Do not treat a passed signature scan as proof that firmware is clean.
- Do not use sudo or world-writable package directories to solve logging errors.
- Do not run live-driver commands when the task requires offline static analysis.
Frequently Asked Questions
Which firmware formats are supported?
The guide covers common UEFI images, including BIN, ROM, FD, CAP, SCAP, FV, and full flash dumps.
Does offline analysis require root access?
Core offline commands use no kernel driver and should not require root. Configure a writable user-owned log directory instead of using sudo.
Does the workflow modify the firmware image?
The documented scans read the source image. Decode and inventory operations create separate output files and directories.
Can CHIPSEC detect every firmware threat?
No. Signature scans detect known patterns, while unknown implants and vendor-specific changes require deeper manual analysis.
What does a failed or warning result mean?
A warning needs investigation. A failed result needs evidence review and remediation, while parser errors may indicate an unsupported format.
What information should I provide?
Provide the authorized firmware path, analysis goal, known-good baseline when available, and platform code when SPI descriptor parsing is required.
Developer Details
Author
BrownFineSecurityLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
a39a91716eadede5f4cdefd78178fed4e837a128
Maintenance freshness
7/24/2026
Usage
7 downloads · 374 views
File structure
📄 SKILL.md