--- title: "Algorand vulnerability scanner: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-algorand-vulnerability-scanner/ description: "Pins Trail of Bits' Algorand scanner, which treats a short or empty coverage table as an unfinished scan and does not let a clean Tealer run stand in for patterns it never examined." --- # Algorand vulnerability scanner: review, setup & limitations · Undominated.ai > Pins Trail of Bits' Algorand scanner, which treats a short or empty coverage table as an unfinished scan and does not let a clean Tealer run stand in for patterns it never examined. [← Explore all skills](/skills/) SECURITY REVIEW / Trail of Bits # Algorand vulnerability scanner Pins Trail of Bits' Algorand scanner, which treats a short or empty coverage table as an unfinished scan and does not let a clean Tealer run stand in for patterns it never examined. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/tree/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner) SOURCE REVIEW Reviewed 2026-10-14 Evidence 4 linked sources Publisher Trail of Bits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Revision 8e54050ae63c [Read what was—and wasn’t—checked ↓](#review) “Requires a verdict on every listed Algorand pattern and says a clean Tealer run does not cover patterns it never checked.” [Trail of Bits · upstream description ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - A coverage table with a missing row or an empty verdict must be reported as an incomplete scan, and not-applicable requires a reason rather than silence. - A clean Tealer run is evidence only for patterns the tool examined, and a check believed to live in another program still needs a file and line. ### A good fit for - Reviewing a TEAL or PyTeal contract when every pattern in this skill's own list needs a found, clear, or reasoned not-applicable verdict ### Weigh up before choosing - This review did not execute the resource. - `/plugin install trailofbits/skills/plugins/building-secure-contracts` installs the building-secure-contracts plugin, not this skill alone. - `/plugin marketplace add trailofbits/skills` adds the Trail of Bits marketplace, not this skill. - resources/VULNERABILITY_PATTERNS.md was not opened. The finding template contains an attack narrative. This review did not reproduce it. - The skill says it will provide fixes. It does not separate a dry-run from an edit, and no edit was made. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/building-secure-contracts/skills/algorand-vulnerability-scanner/SKILL.md - plugins/building-secure-contracts/README.md - README.md - LICENSE ### Our findings - The skill requires one coverage row for every pattern in its own list. A shorter table, or a row whose verdict cell is empty, is an incomplete scan. - Not-applicable is allowed only with a one-clause reason. Not having looked does not qualify. - A zero-finding scan still has to emit the full coverage table. Severity is ranked after that table is complete, not by dropping rows. - A clean Tealer run does not decide patterns the tool never examined. The report has to say which patterns it covered. - A validation assumed to exist in another program is not accepted without a file and line. ### Not established by this review - The resource was not executed, and Tealer was not installed or run. - resources/VULNERABILITY_PATTERNS.md was not opened. - No contract was scanned and no suggested fix was applied. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/README.md) DOCUMENTED COMMAND /plugin install trailofbits/skills/plugins/building-secure-contracts Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - The plugin README shows the command above. It installs the building-secure-contracts plugin, which contains this skill and the plugin's other skills. It does not install this file alone. - The repository README shows `/plugin marketplace add trailofbits/skills`, which adds the marketplace and not this skill, then `/plugin menu` to browse plugins. - The Codex section uses `codex plugin marketplace add trailofbits/skills` and a placeholder plugin name. The placeholder was not used as the command. ### Before you start - Claude Code or Codex marketplace support - A TEAL or PyTeal tree if the skill is used as written ### Compatibility Claude Code · Codex ### Implementation TEAL · PyTeal ### Local review skill; it reads contract text and does not itself submit a transaction - Read the skill text - Read TEAL or PyTeal the operator points at - Run Tealer only if the operator chooses to - Does not authorize submitting a transaction or applying a fix ### Cost model CC-BY-SA-4.0; the skill was not run 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [algorand-vulnerability-scanner SKILL.md ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner/SKILL.md Supports: incomplete-table refusal, not-applicable rule, and Tealer-is-not-a-full-verdict rule - [building-secure-contracts plugin README ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/building-secure-contracts/README.md Supports: plugin install line for the whole building-secure-contracts plugin - [Repository README ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md Supports: marketplace install line and CC-BY-SA-4.0 statement - [Repository LICENSE ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE Supports: Creative Commons Attribution-ShareAlike 4.0 International KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Solana vulnerability scanner ↗ Pins Trail of Bits' Solana scanner, which refuses a short coverage table, keeps the version-scoped row, and does not treat passing lints or an Anchor attribute as a full check.](/skills/trailofbits-solana-vulnerability-scanner/)[### CodeQL ↗ Drives a CodeQL scan and warns that each Bash call is a fresh shell, so state must be written to files.](/skills/trailofbits-codeql/)[### Entry-point analyzer ↗ Lists state-changing smart-contract entry points and their access class, and excludes view functions, exploit writing, and non-contract code.](/skills/trailofbits-entry-point-analyzer/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)