# algorand-vulnerability-scanner

Checks Algorand contracts written in TEAL or PyTeal against 11 known vulnerability patterns, from rekeying to unprotected admin calls.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 5200 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/algorand-vulnerability-scanner

## What it does

Point the skill at a repository and it locates `.teal` files plus `.py` files that import PyTeal or algosdk. Every file is then walked through 11 patterns drawn from Trail of Bits' vulnerability database: rekeying, an unvalidated transaction fee, `CloseRemainderTo` and `AssetCloseTo`, a missing `Global.group_size()` check, time-based replay, unprotected update and delete calls, an unverified Asset ID, transfers that strand on accounts which never opted in, inner transaction fees, and the clear state program. Findings come with a coverage table — all 11 rows get a verdict, including the ones that came back clean — and a `file:line` reference for anything flagged.

When Tealer is present, the skill also shells out to it: `tealer contract.teal --detect all`, or narrower detectors such as `unprotected-rekey,group-size-check,update-application-check`. Install it with `uv tool install tealer` and keep uv's tool bin directory on `PATH`, or the command simply won't resolve. The manual sweep still runs without Tealer; you just lose the automated pass.

The workflow moves through contract type (stateful application or smart signature), approval and clear state programs, a per-transaction-type checklist, atomic groups, and access control. It targets Algorand specifically, so the pattern set won't transfer to another chain.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill algorand-vulnerability-scanner -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/algorand-vulnerability-scanner/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/algorand-vulnerability-scanner/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill algorand-vulnerability-scanner -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/algorand-vulnerability-scanner/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill algorand-vulnerability-scanner -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/algorand-vulnerability-scanner/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills algorand-vulnerability-scanner
```

2. **Manually: put the files in place**
- File: `.github/skills/algorand-vulnerability-scanner/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill algorand-vulnerability-scanner -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/building-secure-contracts/skills/algorand-vulnerability-scanner
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/algorand-vulnerability-scanner/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill algorand-vulnerability-scanner -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/building-secure-contracts/skills/algorand-vulnerability-scanner/SKILL.md

## When to use it
- catch an unchecked `RekeyTo` on a payment branch
- confirm the fee is validated in a smart signature
- stop account and asset draining via `CloseRemainderTo` and `AssetCloseTo`
- verify update and delete calls sit behind an authorization check
- check `Global.group_size()` inside an atomic group

## Example prompts
- Scan the Algorand contracts in this project for vulnerabilities and show the coverage table for all 11 patterns
- Check `approval_program.py` for rekeying and unprotected update calls
- Run Tealer over `contract.teal` with every detector and walk me through the findings

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md