ArduPilot Drone Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:34 PM UTC
• Version: 1.0.0

Overview

This skill openly controls ArduPilot drones, but its default flight examples use unsafe force-arming and immediate takeoff patterns that need human review.

Use this only with explicit human authorization and preferably in SITL or another controlled test setup. Before any real vehicle use, remove force-arming from normal workflows, verify the exact vehicle target, wait for command acknowledgements, validate GPS/EKF/battery/geofence/failsafes and launch-area safety, and pin pymavlink in a dedicated virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:22

Finding

Forced Arming Bypasses Vehicle Safety Checks Before Immediate Takeoff

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-25; repeated at lines 86-89 and 166-169
Vulnerability Type: Unsafe forced arming and missing command validation
Risk Level: High

python

master.mav.command_long_send(1, 1, 400, 0, 1, 21196, 0, 0, 0, 0, 0)  # ARM (force=21196)
mode_map = master.mode_mapping()
master.set_mode(mode_map['GUIDED'])  # GUIDED
master.mav.command_long_send(1, 1, 22, 0, 0, 0, 0, 0, 0, 0, 5)  # TAKEOFF 5m

Technical Analysis

The documented arming command supplies ArduPilot's force-arm value, 21196. This deliberately bypasses normal pre-arm safety checks. The procedure then immediately switches the vehicle to GUIDED mode and requests takeoff without validating a COMMAND_ACK response for arming or mode transition.

Although another section recommends checking GPS, that check is not enforced in any takeoff example. The workflow also does not validate battery condition, EKF health, geofence state, sensor readiness, operator authorization, target identity, or whether the vehicle is in a safe launch area. Fixed system and component identifiers (1, 1) further increase the chance of directing safety-critical commands to an unintended MAVLink target.

The same unsafe sequence is presented multiple times, making it the recommended operational pattern rather than an isolated example.

Attack Path

1. An operator or agent follows the Skill's documented takeoff procedure.
2. The client connects to a MAVLink endpoint and waits only for a standby heartbeat.
3. The client sends MAV_CMD_COMPONENT_ARM_DISARM with the force-arm magic value.
4. ArduPilot bypasses applicable pre-arm checks that would ordinarily prevent unsafe arming.
5. Without waiting for or validating command acknowledgements, the client switches to GUIDED mode and sends MAV_CMD_NAV_TAKEOFF.
6. An unhealthy, incorrectly configured, or unintended vehicle may arm and attempt to take off.

Impact

...[truncated 476 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the force-arm value from standard operating instructions and use normal arming procedures.
• Reserve forced arming for explicitly documented emergency or controlled test scenarios, protected by a separate operator-confirmation step.
• Verify the expected system ID, component ID, vehicle type, autopilot type, and connection endpoint before issuing commands.
• Enforce preflight validation of GPS fix, EKF status, sensor health, battery state, geofence configuration, failsafe configuration, home position, and launch-area safety.
• Wait for and validate COMMAND_ACK after arming, mode changes, takeoff, and landing commands.
• Confirm that the vehicle is armed and in the intended mode before requesting takeoff.
• Add bounded timeouts and safe abort behavior to all readiness loops.
• On any failed or missing acknowledgement, stop the sequence and transition to a documented safe state rather than continuing.
• Require explicit human authorization immediately before safety-critical commands are issued.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:213

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 213-217
Vulnerability Type: Mutable and unverifiable dependency installation
Risk Level: Medium

bash

pip install pymavlink

Technical Analysis

The installation instruction retrieves the latest package version resolved by pip without a version constraint, lock file, integrity hash, or explicitly trusted package index. Consequently, installations are not reproducible, and the code installed in the future may differ from the version originally reviewed.

If the selected package release or configured package repository is compromised, package installation can execute attacker-controlled build or installation logic. The risk is greater when users run the command in a privileged system environment rather than an isolated virtual environment.

No evidence establishes that pymavlink is currently malicious. The issue is the unsafe dependency acquisition process and the resulting supply-chain exposure.

Attack Path

1. A user follows the dependency installation instruction.
2. pip resolves pymavlink using the user's configured index and selects a mutable latest release.
3. A compromised repository, compromised package release, or unsafe index configuration supplies attacker-controlled package content.
4. Package build or installation code runs with the permissions of the user invoking pip.
5. The installed code can subsequently execute when the Skill imports and uses pymavlink.

Impact Assessment

Exploitation could execute code with the installing user's privileges. Depending on that account's permissions, the scope could include access to user files, environment credentials, MAVLink endpoints, vehicle-control channels, and other resources available to the Python process. If installation is performed as an administrator, the impact could extend system-wide.

Remediation

View remediation

Remediation Suggestions

• Pin pymavlink to a specifically reviewed version.
• Maintain dependencies in a lock file with cryptographic hashes, such as a hash-locked requirements file.
• Install from an explicitly configured and trusted package index.
• Use pip install --require-hashes where supported by the dependency workflow.
• Perform installation inside a dedicated virtual environment or container with minimal permissions.
• Avoid running package installation as root or an administrator.
• Add automated dependency vulnerability and provenance checks to the release process.
• Review and deliberately update the pinned version rather than automatically consuming the latest release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill provides concrete arming, takeoff, movement, and landing procedures for a physical drone without adequate safety gating such as prop-area clearance, geofence checks, manual override readiness, local legal compliance, or simulation-first guidance. In this context, omission of operational safety warnings is dangerous because the instructions directly enable immediate real-world actuation of an aircraft, creating risk of injury, property damage, or loss of control.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation instructs use of force-arm with the ArduPilot magic value 21196 but does not explain that this may bypass normal pre-arm safety protections. That is especially dangerous in a drone-control skill because it can encourage operators or agents to defeat safeguards intended to prevent arming under unsafe conditions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language instructions and description are presented in Chinese throughout the file, and the skill does not indicate that this language choice is optional or limited to a justified region-specific audience. Per the stated policy, forcing a specific language without user opt-in is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

# 3. 监控高度
for i in range(40):
    msg = master.recv_match(type='GLOBAL_POSITION_INT', timeout=0.5)
    if msg:
        alt = msg.relative_alt / 1000
        if alt >= 4.5:

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

# 3. 监控高度
for i in range(40):
    msg = master.recv_match(type='GLOBAL_POSITION_INT', timeout=0.5)
    if msg:
        alt = msg.relative_alt / 1000
        if alt >= 4.5:

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

# 3. 监控高度
for i in range(40):
    msg = master.recv_match(type='GLOBAL_POSITION_INT', timeout=0.5)
    if msg:
        alt = msg.relative_alt / 1000
        if alt >= 4.5:

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

# 3. 监控高度
for i in range(40):
    msg = master.recv_match(type='GLOBAL_POSITION_INT', timeout=0.5)
    if msg:
        alt = msg.relative_alt / 1000
        if alt >= 4.5:

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

# 3. 监控高度
for i in range(40):
    msg = master.recv_match(type='GLOBAL_POSITION_INT', timeout=0.5)
    if msg:
        alt = msg.relative_alt / 1000
        if alt >= 4.5:

Static analysis

No suspicious patterns detected.