SECURITY REVIEW / Trail of Bits
Algorand vulnerability scanner
Pins Trail of Bits' Algorand scanner, which treats a short or empty coverage table as an unfinished scan and does not let a clean Tealer run stand in for patterns it never examined.
“Requires a verdict on every listed Algorand pattern and says a clean Tealer run does not cover patterns it never checked.”
01 / THE REASONING
Why this made the selection.
- A coverage table with a missing row or an empty verdict must be reported as an incomplete scan, and not-applicable requires a reason rather than silence.
- A clean Tealer run is evidence only for patterns the tool examined, and a check believed to live in another program still needs a file and line.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/building-secure-contracts/skills/algorand-vulnerability-scanner/SKILL.md
- plugins/building-secure-contracts/README.md
- README.md
- LICENSE
Our findings
- The skill requires one coverage row for every pattern in its own list. A shorter table, or a row whose verdict cell is empty, is an incomplete scan.
- Not-applicable is allowed only with a one-clause reason. Not having looked does not qualify.
- A zero-finding scan still has to emit the full coverage table. Severity is ranked after that table is complete, not by dropping rows.
- A clean Tealer run does not decide patterns the tool never examined. The report has to say which patterns it covered.
- A validation assumed to exist in another program is not accepted without a file and line.
Not established by this review
- The resource was not executed, and Tealer was not installed or run.
- resources/VULNERABILITY_PATTERNS.md was not opened.
- No contract was scanned and no suggested fix was applied.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin install trailofbits/skills/plugins/building-secure-contractsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- The plugin README shows the command above. It installs the building-secure-contracts plugin, which contains this skill and the plugin's other skills. It does not install this file alone.
- The repository README shows `/plugin marketplace add trailofbits/skills`, which adds the marketplace and not this skill, then `/plugin menu` to browse plugins.
- The Codex section uses `codex plugin marketplace add trailofbits/skills` and a placeholder plugin name. The placeholder was not used as the command.
Before you start
- Claude Code or Codex marketplace support
- A TEAL or PyTeal tree if the skill is used as written
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner/SKILL.md
Supports: incomplete-table refusal, not-applicable rule, and Tealer-is-not-a-full-verdict rule
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/README.md
Supports: plugin install line for the whole building-secure-contracts plugin
- Repository README ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md
Supports: marketplace install line and CC-BY-SA-4.0 statement
- Repository LICENSE ↗Checked
https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE
Supports: Creative Commons Attribution-ShareAlike 4.0 International