𝗧𝗲𝘀𝘁𝗶𝗻𝗴 𝗚𝗲𝗺𝗶𝗻𝗶𝗖𝗟𝗜 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗘𝘅𝘁𝗲𝗻𝘀𝗶𝗼𝗻𝘀 𝗼𝗻 𝗖𝗼𝗱𝗲𝗫

𝗧𝗲𝘀𝘁𝗶𝗻𝗴 𝗚𝗲𝗺𝗶𝗻𝗶𝗖𝗟𝗜 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗘𝘅𝘁𝗲𝗻𝘀𝗶𝗼𝗻𝘀 𝗼𝗻 𝗖𝗼𝗱𝗲𝗫

I tested two new Gemini CLI extensions on the CodeX source code. These tools help with code reviews and security scans.

𝗧𝗵𝗲 𝗘𝘅𝘁𝗲𝗻𝘀𝗶𝗼𝗻𝘀

• Code Review Extension: This tool checks code changes for quality. Use the /code-review command to start. • Security Extension: This tool performs SAST scans. It finds vulnerabilities and provides fix suggestions. Use /security:analyze to start.

𝗛𝗼𝘄 𝘁𝗼 𝗜𝗻𝘀𝘁𝗮𝗹𝗹

You can install them using these commands:

❯ gemini extensions install https://github.com/gemini-cli-extensions/security ❯ gemini extensions install https://github.com/gemini-cli-extensions/code-review

𝗧𝗲𝘀𝘁 𝗥𝗲𝘀𝘂𝗹𝘁𝘀

I ran the security scan on 65 files from the CodeX repository. The tool found several issues:

• High Severity: Path Traversal in read_file.rs. The code does not restrict file access to a specific directory. • Medium Severity: Potential Prompt Injection in codex.rs. User input goes to the model without sanitization. • Medium Severity: Information Disclosure in otel_event_manager.rs. Sensitive prompts might get logged. • Low Severity: Hardcoded password in the GitHub release workflow.

𝗧𝗵𝗲 𝗖𝗼𝘀𝘁 𝗼𝗳 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆

Running these scans comes with a price in time and money. For 65 files, the results were:

• Time: 36 minutes. • Cost: 23.88 USD.

The speed is similar to traditional SAST tools. The cost is currently high for daily use. You might want to wait for more optimized tools before using this for every scan.

𝗧𝗶𝗽 𝗳𝗼𝗿 𝗨𝘀𝗲𝗿𝘀

Do not use a standard Google login for large scans. It often fails with error messages. Instead, use a Gemini API Key or Vertex AI for better stability.

Source: https://dev.to/jh5_pulse/shi-ce-geminicli-security-extensions-lai-review-codex-yuan-shi-ma-4h40

Optional learning community: https://t.me/GyaanSetuAi