algorand-vulnerability-scanner — Claude Code skill: audit Algorand

What algorand-vulnerability-scanner does

Point the skill at a repository and it locates .teal files plus .py files that import PyTeal or algosdk. Every file is then walked through 11 patterns drawn from Trail of Bits' vulnerability database: rekeying, an unvalidated transaction fee, CloseRemainderTo and AssetCloseTo, a missing Global.group_size() check, time-based replay, unprotected update and delete calls, an unverified Asset ID, transfers that strand on accounts which never opted in, inner transaction fees, and the clear state program. Findings come with a coverage table — all 11 rows get a verdict, including the ones that came back clean — and a file:line reference for anything flagged.

When Tealer is present, the skill also shells out to it: tealer contract.teal --detect all, or narrower detectors such as unprotected-rekey,group-size-check,update-application-check. Install it with uv tool install tealer and keep uv's tool bin directory on PATH, or the command simply won't resolve. The manual sweep still runs without Tealer; you just lose the automated pass.

The workflow moves through contract type (stateful application or smart signature), approval and clear state programs, a per-transaction-type checklist, atomic groups, and access control. It targets Algorand specifically, so the pattern set won't transfer to another chain.