ArduPilot Drone Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:34 PM UTC
• Version: 1.0.0

Overview

This skill openly controls ArduPilot drones, but its default flight examples use unsafe force-arming and immediate takeoff patterns that need human review.

Use this only with explicit human authorization and preferably in SITL or another controlled test setup. Before any real vehicle use, remove force-arming from normal workflows, verify the exact vehicle target, wait for command acknowledgements, validate GPS/EKF/battery/geofence/failsafes and launch-area safety, and pin pymavlink in a dedicated virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:22
• Finding: Forced Arming Bypasses Vehicle Safety Checks Before Immediate Takeoff## Vulnerability Details **File Location**: `SKILL.md`, lines 22-25; repeated at lines 86-89 and 166-169 **Vulnerability Type**: Unsafe forced arming and missing command validation **Risk Level**: High ```python master.mav.command_long_send(1, 1, 400, 0, 1, 21196, 0, 0, 0, 0, 0) # ARM (force=21196) mode_map = master.mode_mapping() master.set_mode(mode_map['GUIDED']) # GUIDED master.mav.command_long_send(1, 1, 22, 0, 0, 0, 0, 0, 0, 0, 5) # TAKEOFF 5m ``` ### Technical Analysis The documented arming command supplies ArduPilot's force-arm value, `21196`. This deliberately bypasses normal pre-arm safety checks. The procedure then immediately switches the vehicle to `GUIDED` mode and requests takeoff without validating a `COMMAND_ACK` response for arming or mode transition. Although another section recommends checking GPS, that check is not enforced in any takeoff example. The workflow also does not validate battery condition, EKF health, geofence state, sensor readiness, operator authorization, target identity, or whether the vehicle is in a safe launch area. Fixed system and component identifiers (`1, 1`) further increase the chance of directing safety-critical commands to an unintended MAVLink target. The same unsafe sequence is presented multiple times, making it the recommended operational pattern rather than an isolated example. ### Attack Path 1. An operator or agent follows the Skill's documented takeoff procedure. 2. The client connects to a MAVLink endpoint and waits only for a standby heartbeat. 3. The client sends `MAV_CMD_COMPONENT_ARM_DISARM` with the force-arm magic value. 4. ArduPilot bypasses applicable pre-arm checks that would ordinarily prevent unsafe arming. 5. Without waiting for or validating command acknowledgements, the client switches to `GUIDED` mode and sends `MAV_CMD_NAV_TAKEOFF`. 6. An unhealthy, incorrectly configured, or unintended vehicle may arm and attempt to take off. ### Impact ...[truncated 476 chars]
• Remediation: ## Remediation Suggestions - Remove the force-arm value from standard operating instructions and use normal arming procedures. - Reserve forced arming for explicitly documented emergency or controlled test scenarios, protected by a separate operator-confirmation step. - Verify the expected system ID, component ID, vehicle type, autopilot type, and connection endpoint before issuing commands. - Enforce preflight validation of GPS fix, EKF status, sensor health, battery state, geofence configuration, failsafe configuration, home position, and launch-area safety. - Wait for and validate `COMMAND_ACK` after arming, mode changes, takeoff, and landing commands. - Confirm that the vehicle is armed and in the intended mode before requesting takeoff. - Add bounded timeouts and safe abort behavior to all readiness loops. - On any failed or missing acknowledgement, stop the sequence and transition to a documented safe state rather than continuing. - Require explicit human authorization immediately before safety-critical commands are issued.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:213
• Finding: Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 213-217 **Vulnerability Type**: Mutable and unverifiable dependency installation **Risk Level**: Medium ```bash pip install pymavlink ``` ### Technical Analysis The installation instruction retrieves the latest package version resolved by `pip` without a version constraint, lock file, integrity hash, or explicitly trusted package index. Consequently, installations are not reproducible, and the code installed in the future may differ from the version originally reviewed. If the selected package release or configured package repository is compromised, package installation can execute attacker-controlled build or installation logic. The risk is greater when users run the command in a privileged system environment rather than an isolated virtual environment. No evidence establishes that `pymavlink` is currently malicious. The issue is the unsafe dependency acquisition process and the resulting supply-chain exposure. ### Attack Path 1. A user follows the dependency installation instruction. 2. `pip` resolves `pymavlink` using the user's configured index and selects a mutable latest release. 3. A compromised repository, compromised package release, or unsafe index configuration supplies attacker-controlled package content. 4. Package build or installation code runs with the permissions of the user invoking `pip`. 5. The installed code can subsequently execute when the Skill imports and uses `pymavlink`. ### Impact Assessment Exploitation could execute code with the installing user's privileges. Depending on that account's permissions, the scope could include access to user files, environment credentials, MAVLink endpoints, vehicle-control channels, and other resources available to the Python process. If installation is performed as an administrator, the impact could extend system-wide.
• Remediation: ## Remediation Suggestions - Pin `pymavlink` to a specifically reviewed version. - Maintain dependencies in a lock file with cryptographic hashes, such as a hash-locked requirements file. - Install from an explicitly configured and trusted package index. - Use `pip install --require-hashes` where supported by the dependency workflow. - Perform installation inside a dedicated virtual environment or container with minimal permissions. - Avoid running package installation as root or an administrator. - Add automated dependency vulnerability and provenance checks to the release process. - Review and deliberately update the pinned version rather than automatically consuming the latest release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill provides concrete arming, takeoff, movement, and landing procedures for a physical drone without adequate safety gating such as prop-area clearance, geofence checks, manual override readiness, local legal compliance, or simulation-first guidance. In this context, omission of operational safety warnings is dangerous because the instructions directly enable immediate real-world actuation of an aircraft, creating risk of injury, property damage, or loss of control.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The documentation instructs use of force-arm with the ArduPilot magic value 21196 but does not explain that this may bypass normal pre-arm safety protections. That is especially dangerous in a drone-control skill because it can encourage operators or agents to defeat safeguards intended to prevent arming under unsafe conditions.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The natural-language instructions and description are presented in Chinese throughout the file, and the skill does not indicate that this language choice is optional or limited to a justified region-specific audience. Per the stated policy, forcing a specific language without user opt-in is a locale/language policy violation.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

# 3. 监控高度
for i in range(40):
    msg = master.recv_match(type='GLOBAL_POSITION_INT', timeout=0.5)
    if msg:
        alt = msg.relative_alt / 1000
        if alt >= 4.5:

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

# 3. 监控高度
for i in range(40):
    msg = master.recv_match(type='GLOBAL_POSITION_INT', timeout=0.5)
    if msg:
        alt = msg.relative_alt / 1000
        if alt >= 4.5:

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

# 3. 监控高度
for i in range(40):
    msg = master.recv_match(type='GLOBAL_POSITION_INT', timeout=0.5)
    if msg:
        alt = msg.relative_alt / 1000
        if alt >= 4.5:

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

# 3. 监控高度
for i in range(40):
    msg = master.recv_match(type='GLOBAL_POSITION_INT', timeout=0.5)
    if msg:
        alt = msg.relative_alt / 1000
        if alt >= 4.5:

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

# 3. 监控高度
for i in range(40):
    msg = master.recv_match(type='GLOBAL_POSITION_INT', timeout=0.5)
    if msg:
        alt = msg.relative_alt / 1000
        if alt >= 4.5:

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Static analysis

No suspicious patterns detected.