mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-21 12:10:59 +03:00
mukul975
8cae0648ec
Demand-driven expansion targeting the fastest-growing 2025-2026 threat and
skills categories (ISC2/WEF/CrowdStrike/Mandiant signals):
- AI Security (NEW domain, 12 skills): LLM red-teaming with garak/PyRIT,
prompt injection (direct/indirect/RAG), MCP tool-poisoning, agentic tool
invocation, guardrails, model/data poisoning, system-prompt leakage,
embedding/vector weaknesses, model extraction, continuous red-teaming
- Supply Chain Security (NEW domain, 5 skills): SBOMs, dependency confusion,
malicious-npm triage, typosquatting, SLSA/Sigstore provenance
- Hardware & Firmware Security (NEW domain, 4 skills): CHIPSEC/UEFI audit,
Secure Boot bypass, TPM measured-boot attestation, ESP bootkit hunting
- Identity (10): Entra ID/ROADtools, GraphRunner, AADInternals, ADCS/Certipy,
shadow credentials, coercion, BloodHound CE, device-code phishing, SSO abuse
- Cloud-native (8): Stratus, Pacu, CloudFox, container escape, K8s RBAC,
Falco, Trivy, kube-bench
- Offensive C2 (6): Sliver, Havoc, NetExec, DPAPI, NTLM relay ESC8, redirectors
- DFIR (6): Hayabusa, Chainsaw, KAPE, Velociraptor, EZ Tools, Plaso
- Backfill (4): OpenCTI, MISP, honeytokens, post-quantum crypto migration
Each skill follows the repo taxonomy (SKILL.md + references/{standards,api-reference}.md
+ scripts/agent.py + LICENSE), with researched real tool commands (no placeholders),
complete frontmatter, and ATT&CK/ATLAS + NIST CSF mappings. Updates README domain
table, skill count, and index.json.
2.3 KiB
2.3 KiB
Command Reference - CHIPSEC
chipsec_main (test suite)
| Command / Flag | Purpose |
|---|---|
chipsec_main |
Run all applicable security modules for the platform |
-m, --module <name> |
Run a specific module, e.g. -m common.bios_wp |
-m common |
Run the whole OEM-independent module group |
-mx <modules> |
Exclude listed modules |
-a, --module_args |
Pass arguments to a module (e.g. -a modify) |
-p, --platform <code> |
Force platform code when auto-detect fails |
-n, --no_driver |
Skip checks requiring the kernel driver |
-l, --log <file> |
Write output to a log file |
-j, --json <file> |
JSON results output |
-x, --xml <file> |
JUnit-style XML results output |
-v / -vv / -d |
Verbose / very verbose / debug logging |
Key security modules
| Module | Checks |
|---|---|
common.bios_wp |
BIOS_CNTL BLE / SMM_BWP and SPI Protected Ranges |
common.spi_lock |
SPI flash descriptor FLOCKDN lock |
common.spi_access |
SPI flash region access permissions |
common.smrr |
SMRR programming (SMRAM cache protection) |
common.smm |
SMM BIOS write protection |
common.secureboot.variables |
Secure Boot variable protection (-a modify to test writes) |
common.uefi.s3bootscript |
S3 resume boot-script protection |
chipsec_util (manual access)
| Command | Purpose |
|---|---|
chipsec_util spi info |
Report SPI flash regions/descriptor/permissions |
chipsec_util spi dump rom.bin |
Dump entire SPI flash to file |
chipsec_util spi read <addr> <len> out.bin |
Read SPI flash range |
chipsec_util decode rom.bin |
Decode dumped image into volumes/files/variables |
chipsec_util uefi var-list |
List UEFI variables (runtime) |
chipsec_util uefi var-find <name> |
Find a UEFI variable |
chipsec_util uefi var-read <name> <GUID> out.bin |
Read a variable |
chipsec_util uefi decode rom.bin |
Decode UEFI firmware structure from image |
chipsec_util platform |
Show detected platform info |
Result interpretation
| Result | Meaning |
|---|---|
| PASSED | Protection is correctly enabled |
| FAILED | Protection missing/misconfigured — exploitable |
| WARNING | Potential issue / needs manual review |
| INFORMATION | Informational, no pass/fail |