The Things Network

• Outcome: Review
• Latest audit: May 29, 2026 at 9:37 PM UTC
• Version:
  1.0.2

Overview

This is a coherent The Things Network integration, but it needs review because it gives an agent broad authenticated API access that can change or delete IoT resources without clear confirmation rules.

Install only if you trust Membrane to mediate The Things Network authentication and API traffic. Use least-privilege TTN access, prefer listed Membrane actions, and require explicit approval before any raw proxy request that creates, updates, deletes, sends downlinks, or changes device/application configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill exposes a generic proxy request mechanism that supports destructive HTTP methods like POST, PUT, PATCH, and DELETE, but it does not require confirmation or warn that these operations may modify or delete TTN resources. In an agent setting, this increases the chance of unintended state-changing requests against real IoT infrastructure, especially if the agent falls back to raw API usage when prebuilt actions are unavailable.

VirusTotal

63/63 vendors flagged this skill as clean.