gemini-cli-extensions/security

What it solves

This extension for the Gemini CLI identifies security vulnerabilities and risks in code changes, specifically targeting pull requests to catch issues early in the development cycle. It also scans for known vulnerabilities in project dependencies.

How it works

It adds two primary commands to the Gemini CLI:

• /security:analyze: Uses Gemini's AI to perform a context-aware security analysis of code diffs. Users can customize the analysis scope using natural language instructions or request output in JSON format.
• /security:scan-deps: Integrates with OSV-Scanner to cross-reference project dependencies against the OSV.dev vulnerability database to identify vulnerable packages and provide remediation guidance.

Who it’s for

Developers and security engineers who use the Gemini CLI and want to integrate automated AI-powered security reviews into their local workflow or GitHub Actions CI/CD pipelines.

Highlights

• AI-Powered Analysis: Detects a wide range of vulnerabilities including hardcoded secrets, injection attacks (XSS, SQLi, SSRF), insecure data handling, and authentication bypasses.
• LLM-Specific Security: Specifically flags prompt injection risks, improper handling of LLM outputs, and insecure plugin/tool usage.
• Dependency Scanning: Automates the detection of known vulnerabilities in open-source dependencies via OSV-Scanner.
• GitHub Integration: Can be integrated into GitHub workflows to automatically analyze incoming code in pull requests.
• High Accuracy: Benchmarked against the OpenSSF CVE Benchmark with 90% precision and 93% recall.