Gemini CLI Security Extension
A Google extension for Gemini CLI that finds vulnerabilities in branch changes and checks dependencies with OSV-Scanner
Install
gemini extensions install https://github.com/gemini-cli-extensions/securityRequires Gemini CLI 0.4.0 or newer.
This is third-party code. Review the repository files before installing.
What it does
The extension adds a /security:analyze command to Gemini CLI that reviews changes on the current branch against origin/HEAD and produces a vulnerability report. It looks for hardcoded secrets, weak crypto, sensitive data in logs, injections, SSRF, authentication flaws and LLM risks such as prompt injection. You can narrow or widen the scope in plain language, and the report is available as JSON. The /security:scan-deps command checks dependencies against OSV.dev and suggests versions to upgrade to.
Who it is for. For developers and teams already on Gemini CLI who want a first security pass before merging.
Good fit when
- You want to check changes for common vulnerabilities before opening a pull request
- You need to find dependencies with known CVEs
- You want security checks in GitHub Actions reviews
Not a fit when
- You need a full security audit: the authors call the report a first pass
- You need /security:analyze non-interactively, which is not supported yet
Example request
/security:analyze check only the scripts folder, skip docs and config filesLimitations
Works only in Gemini CLI 0.4.0 or newer, and the analysis runs on Gemini models. The Gemini API is not reachable from Russia without a VPN. The report does not replace manual review or other scanners.
How to disable. Run gemini extensions uninstall security or disable it with gemini extensions disable.
Security check
- Reads source code and sends it to Gemini models
- Runs OSV-Scanner and queries OSV.dev
README in short
The README covers installation with a single gemini extensions install command and the extension's two commands: change analysis and dependency scanning. It lists the vulnerability classes, including a section on LLM application safety. There are steps for GitHub integration via run-gemini-cli and a description of a benchmark on the OpenSSF CVE dataset. Apache 2.0 licensed.
FAQ
What is analyzed by default?
The diff between the current branch and origin/HEAD via git diff --merge-base. You can set a different scope in text after the command.
Can it run in CI?
Yes, the repo includes a run-gemini-cli example workflow that adds a security analysis step to pull request reviews.
Related
NVIDIA's open stack for running OpenClaw, Hermes and LangChain Deep Agents in OpenShell sandboxes with network policy and managed inference
Static code analysis with rules that look like source code, plus a built-in MCP server for AI agents
Trail of Bits skills
Trail of Bits Skills Marketplace
Trail of Bits plugin marketplace for security work: smart contracts, C/C++ and Rust review, Semgrep, CodeQL and fuzzing
A cybersecurity skill library: forensics, incident response, pentesting, cloud and malware analysis mapped to MITRE ATT&CK and NIST