security-scan

To scan Gemini Code configurations for security vulnerabilities, inspect your .gemini directories including GEMINI.md, settings.json, mcp.json, hooks, and agent definitions to detect hardcoded secrets, dangerous permissions, and command injection patterns before commits.

Gemini settings.json and mcp.json files can contain security risks including hardcoded secrets, dangerous permissions, command injection vectors, and prompt-injection patterns that configuration audits detect and grade by severity.

You can automate Gemini configuration security checks in CI pipelines and pre-commit hooks by running configuration scans that produce JSON reports for CI integration, enabling automated gatekeeping for repository onboarding and configuration hygiene.

Gemini configuration scans support auto-fix by applying only safe, auto-fixable recommendations automatically to resolve insecure settings, and optionally run adversarial three-agent threat modeling when API credentials are provided for deeper analysis.

Gemini configuration security audits produce graded findings exportable as terminal output for quick review, JSON for CI integration, Markdown for documentation, and HTML reports for detailed human review of detected vulnerabilities.

AgentShield compatibility is required to scan .gemini directories for security risks, ensuring configuration audits properly detect prompt-injection patterns and generate graded severity reports across GEMINI.md and associated configuration files.