security-scan

To scan Gemini CLI configurations, run the security scanner against your project's .gemini directory to detect hardcoded secrets, prompt injection risks, and risky MCP servers. It audits GEMINI.md, settings.json, mcp.json, hooks, and agent definitions using AgentShield.

Security risks detected in GEMINI.md and mcp.json files include hardcoded secrets, prompt injection patterns, data exfiltration risks, dangerous hooks, and risky MCP server permissions. The scanner analyzes these configurations to identify exposure and provide actionable remediation guidance.

You should run a security audit on your .gemini directory for new projects, after modifying configurations, or as routine security hygiene. This ensures that settings.json, mcp.json, hooks, and agent definitions remain free from newly introduced vulnerabilities.

Yes, the AgentShield scanner checks agent definitions for dangerous access and alerts on risky permissions. It audits the entire .gemini directory to identify potential security vulnerabilities and reports actionable fixes to secure your environment.

Yes, you can get actionable remediation steps for risky permissions in settings.json. The scanner alerts on dangerous hooks and agent access, providing specific guidance to fix configuration vulnerabilities and secure your Gemini setup.

The best way to prevent prompt injection in Gemini agent configurations is to scan GEMINI.md and agent definitions for malicious patterns. The scanner identifies injection risks and data exfiltration attempts, reporting actionable fixes to secure your setup.