algorand-vulnerability-scanner
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill incorporates the
tealersecurity tool for contract analysis, using shell commands for installation (uv tool install tealer) and scanning (tealer contract.teal --detect all). This is standard behavior for a security analysis tool developed by the vendor. - [INDIRECT_PROMPT_INJECTION]: The skill processes external smart contract files (.teal, .py), which serves as a potential vector for indirect prompt injection.
- Ingestion points: TEAL and PyTeal source files located in the project directory as described in the Scanning Workflow.
- Boundary markers: No specific delimiters or security instructions are provided to the agent regarding the ingested code to prevent the AI from following instructions embedded within contract comments.
- Capability inventory: Shell execution of the
tealeranalysis tool. - Sanitization: No sanitization is performed on the contract code before analysis.
Audit Metadata