gemini-cli-security

name	gemini-cli-security
description	AI-powered code vulnerability analysis and dependency scanning using Gemini CLI security extension patterns. Detects hardcoded secrets, injection attacks, weak cryptography, authentication flaws, and LLM prompt injection. Also scans dependencies against the OSV.dev vulnerability database.
version	1.0.0
model	sonnet
invoked_by	both
user_invocable	true
tools	["Read","Write","Bash","WebFetch","Glob","Grep"]
args	[target-path] [--scan-deps] [--json] [--scope <natural-language-scope>]
best_practices	["Analyze code changes in pull requests to catch vulnerabilities early","Always check dependencies for CVEs via OSV.dev integration","Produce structured JSON output for automated pipelines","Flag LLM-specific risks (prompt injection, unsafe output handling)","Report precision and recall benchmarks when assessing coverage"]
error_handling	graceful
streaming	supported
verified	false
lastVerifiedAt	"2026-02-19T05:29:09.098Z"
source	builtin
trust_score	100
provenance_sha	bef705454e10ccb7

Gemini CLI Security Skill

AI-powered security analysis skill adapted from the Gemini CLI Security Extension (github.com/gemini-cli-extensions/security). Provides vulnerability detection across code and dependencies with 90% precision and 93% recall on TypeScript/JavaScript CVE datasets. - Code vulnerability analysis (/security:analyze pattern) - OSV.dev dependency scanning (/security:scan-deps pattern) - Hardcoded credentials and secrets detection - Injection attack detection (XSS, SQL, command, SSRF, template) - Weak cryptography and insecure deserialization detection - Authentication and session management flaw detection - LLM-specific risks: prompt injection, unsafe output handling - JSON output formatting for CI/CD pipeline integration - GitHub Actions integration patterns for automated PR analysis

Overview

This skill adapts the Gemini CLI Security Extension's analysis methodology for the agent-studio framework. The original extension uses two MCP server patterns — a security analysis server and an OSV-Scanner integration — to provide dual-vector coverage. This skill implements equivalent analysis using native Claude Code tools (WebFetch for OSV.dev API, Grep/Bash for static analysis patterns).

Source repository: https://github.com/gemini-cli-extensions/security License: Apache 2.0 Performance: 90% precision, 93% recall (OpenSSF CVE benchmark, TypeScript/JavaScript)

When to Use

• Before merging pull requests to detect introduced vulnerabilities
• During security reviews of new code changes
• For dependency auditing against known CVE databases
• For LLM-integrated applications requiring prompt injection defense review
• As part of CI/CD pipeline security gates

Iron Law

NO PRODUCTION CODE WITHOUT SECURITY ANALYSIS FOR AUTH/SECRETS/EXTERNAL-INPUT HANDLERS

All code paths handling authentication, hardcoded values, external input, or AI model outputs MUST be analyzed before production deployment.

Vulnerability Coverage

Category 1: Secrets Management

Pattern	Detection Method
Hardcoded API keys	Grep for key patterns + entropy analysis
Hardcoded passwords	Credential keyword detection
Private keys in source	PEM block / base64 key detection
Encryption keys	Symmetric key constant patterns

Category 2: Injection Attacks