Gemini CLI Security: scan your code for security issues

What it does

What it is

Gemini CLI is Google's command line agent. This extension adds a security review: it looks at your code and at the changes in a pull request and reports problems such as injection, unsafe handling of secrets and weak settings.

Who it helps

Developers who use Gemini CLI and want a quick check before they merge a change.

How to start

Install the extension with the Gemini command, open your project and ask for a security review.

Be careful

The tool sends code to Google's model. Check your company rules first. Use it only on code you are allowed to test. Treat the output as a list of leads to check, not as proof.

How to install

$ gemini extensions install https://github.com/gemini-cli-extensions/security

How to use it

Open Gemini CLI in your own project and ask it to run a security review of the current changes. Read each finding and decide what to fix. Use it only on code you own.

What to watch out for

Your code is sent to Google's Gemini model for analysis. Do not use it on code that you may not share.
Results can include false alarms and can miss real problems.

Licence and author

Licence: Apache-2.0
Author: Google Gemini CLI extensions team
Source code: github.com/gemini-cli-extensions/security

How we tested it

We installed it on an empty test computer on 12 Oct 2026. Partly tested: installed in a clean test system, but its main features need an account or key we did not use.

Test level

Gemini CLI was not installed in the sandbox and no model call was made. The install and the scan were not tested.

Technical details of the test

Date: 12 Oct 2026
Method: Cloned the repository in a clean container with no account. The extension file gemini-extension.json is valid JSON and the repository holds 3 skill files that all have a name and a description. We did not install it in Gemini CLI.

Checked again on 12 Oct 2026

Sources

github.com/gemini-cli-extensions/security