Forge, the Handbook, and the parts database are free — always. The intelligence layer exists because supply chain risk, defense procurement signals, and gray zone scoring aren't public information for a reason. Tiers reflect need-to-know, not ability to pay. If price is a barrier, reach out.
Verifying your payment with Stripe...
If Forge helped you make a better procurement decision, avoid a bad part, or navigate DFR compliance — contribute what you can. No amount too small, no obligation.
Donate →If someone gave you an access code, or you reached out and Jeremiah sent you one — enter it here. You get the same access as a paid subscriber at whatever tier was granted.
This is the intelligence layer most buyers never see — until it's too late.
Risk Level: CRITICAL
SkyRover / Knowact (registered: SZ Knowact Robot Technology Co., Ltd., Shenzhen) is a DJI white-label operating under a US-facing brand with zero supply chain transparency disclosed. Security researcher Jon Sawyer confirmed the SkyRover mobile application connects directly to DJI cloud infrastructure using identical encryption keys — users can authenticate using existing DJI credentials. This represents the most direct adversary data pipeline of any gray zone platform in the DroneClear database. All flight telemetry, GPS coordinates, operator identity, and video data route to Chinese-controlled servers with no opt-out mechanism.
Despite a March 2026 statement referencing a 5-year "exploration" of US manufacturing, SkyRover products remain on retail shelves and are actively marketed to first responders and public safety agencies. No NDAA compliance documentation has been provided to any government buyer. Procurement of SkyRover products for any federal, state, or municipal program creates material legal exposure under NDAA §848, the Secure Equipment Act, and potential procurement fraud statutes.
| Entity | Risk Score | Risk Tier | Country | NDAA Status | Primary Signal |
|---|---|---|---|---|---|
| SkyRover / Knowact SZ Knowact Robot Technology Co., Ltd. |
71% | CRITICAL | China (Shenzhen) | Non-compliant · No §848 pathway | Direct DJI cloud connection confirmed via security research. 100% adversary components. Firmware signed with DJI crypto keys. |
| DJI (parent technology) SZ DJI Technology Co., Ltd. |
98% | CRITICAL | China (Shenzhen) | NDAA §848(b)(1) — Named covered entity | Root key holder for SkyRover firmware. FCC authorization revoked 2024. Ministry of Finance and CITIC Group investor. |
| Flag | Detail | Confidence |
|---|---|---|
| Direct DJI cloud connection — app level | SkyRover app connects DIRECTLY to DJI cloud infrastructure. Jon Sawyer confirmed identical encryption keys. Users can log in using existing DJI credentials. This is the most direct DJI connection of any white-label — no Aloft-style intermediary. All mission data, GPS, and operator PII routes to China. | 95% |
| Technology licensed from adversary entity: DJI (undisclosed) | No licensing agreement acknowledged in any FCC filing, product documentation, or corporate disclosure. Knowact Inc. (Delaware) has not disclosed its relationship with SZ Knowact Robot Technology Co., Ltd. or DJI in any public document. | 95% |
| 100% of components sourced from adversary nations | No domestic or allied-nation components identified in any teardown or FCC filing. All PCBs, sensors, flight controllers, and RF modules traceable to Chinese manufacturers. FCC filings list SZ Knowact Robot Technology Co., Ltd. as manufacturer. | 85% |
| Firmware signed with DJI cryptographic keys | DJI retains root key control over all SkyRover firmware. OTA updates route through adversary infrastructure. No operator visibility or consent mechanism. Any firmware update constitutes a potential foreign-controlled software deployment on operator networks. | 95% |
| OTA update pipeline touches adversary infrastructure | Automatic firmware update pipeline confirmed to route through Chinese-controlled servers. Updates can be deployed to any SkyRover device without operator awareness or approval. No mechanism exists for operators to audit or block updates. | 95% |
| Data hosted in adversary nation (DJI cloud) | All flight data, telemetry, video metadata, and operator location data confirmed hosted on DJI cloud infrastructure in China. No data residency controls. No operator opt-out. Incompatible with any federal or state data sovereignty requirement. | 90% |
| Flag | Detail | Confidence |
|---|---|---|
| DJI SDK embedded — adversary manufacturer | Full DJI Mobile SDK integrated into SkyRover application stack. SDK functions including mapping, telemetry, and control APIs all use DJI endpoints. Removing SDK would require complete platform rebuild. | 95% |
| Manufacturing in adversary nation: China | FCC Equipment Authorization ID references SZ Knowact Robot Technology Co., Ltd. as manufacturer. No third-country assembly claimed. "5-year US manufacturing exploration" (March 2026) is non-binding and does not affect currently shipping product. | 90% |
| Zero corporate transparency — ownership undisclosed | No ownership structure disclosed. No headquarters disclosed. No country of origin voluntarily disclosed. Knowact Inc. (Delaware) shell with no public officers. SkyRover.com provides no corporate information. Marketing assets claim "innovative team" with no named individuals. | 70% |
| Active retail sales to government/public safety | SkyRover F10 Pro and S1/X1 actively available on Amazon, B&H, and direct website. Product descriptions reference public safety and first responder use cases. No NDAA compliance notice. No procurement restriction disclosure on any sales channel. | 90% |
| March 2026 "US manufacturing exploration" — no commitments | Statement issued in response to regulatory pressure contains no timelines, investment commitments, or third-party verification. Use of "explore" rather than "commit." FCC filings unchanged. SZ Knowact still listed as manufacturer on current product line. | 90% |
| No Blue UAS pathway identified | DJI-derived platforms have no viable Blue UAS Framework clearance pathway while DJI remains a covered entity under NDAA §848. Even if SkyRover disclosed its supply chain, the underlying DJI technology dependency would disqualify clearance consideration. | 85% |
| Event | Timeframe | Probability | Impact | Validated |
|---|---|---|---|---|
| Federal enforcement action against gray zone operators or government buyers (SkyRover named) | H2 2026–2027 | CRITICAL | ✓ CV | |
| FCC firmware cliff — 3 simultaneous deadlines ground uncertified gray zone drones (Jan 2027) | Jan 2027 | CRITICAL | ✓ CV | |
| FCC Covered List expansion — gray zone platforms added under Secure Equipment Act amendment | Q3–Q4 2026 | HIGH | — |
| Signal | Detail | Confidence |
|---|---|---|
| Do not procure — federal, state, or municipal programs | Any SkyRover procurement using federal funds constitutes a potential NDAA violation. State and local agencies using SOAR, DHS, or other federal grant funding are similarly prohibited. Non-grant municipal procurement creates supply chain risk and potential future liability if Covered List expands. | 95% |
| Blue UAS alternatives — comparable form factor | Skydio X10D (mapping/ISR), Teal 2 / Black Widow (compact ISR), Censys Sentaero 5 (fixed-wing), Parrot ANAFI USA (lightweight mapping). All cleared on DoD Blue UAS Framework. All available for federal procurement. Forge platform comparison available at /compare/. | — |
| Contract clawback exposure — existing SkyRover deployments | Agencies currently operating SkyRover equipment purchased with federal funds may face audit findings, grant clawback, or corrective action requirements. Legal review recommended before any mission deployment. Three confirmed government buyers of similar gray zone products currently under review. | 70% |
If you subscribed or received a demo token, paste it here to activate your subscription instantly — no account required.