Commit initial extension implementation

[capachino]

No description provided.

[gemini-code-assist]

Summary of Changes

Hello @capachino, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request establishes the foundational implementation for a new security scanning extension. It introduces detailed documentation for performing security audits on pull requests, defines a command for initiating these scans, and provides the necessary configuration for the extension. The changes aim to integrate a structured security review process directly into the development workflow.

Highlights

• New Security Scan Documentation: Introduced GEMINI.md, a comprehensive guide detailing the process for conducting security audits on pull requests. This document outlines phases for change analysis, static application security testing (SAST) covering various vulnerability types (e.g., hardcoded secrets, access control, injection), and reporting guidelines.
• Security Analysis Command Definition: Added commands/security/analyze.toml, which defines a new command for initiating a security review. This command includes a specific prompt to guide a targeted security audit focused on changes introduced in the current pull request.
• Gemini Extension Configuration: Created gemini-extension.json, a configuration file for a new 'gemini-cli-security' extension. This file specifies the extension's name, version, and links to GEMINI.md as its primary context file.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces the initial implementation of a Gemini CLI extension for security scanning. It adds a manifest file (gemini-extension.json), a command definition (commands/security/analyze.toml), and a markdown file with instructions (GEMINI.md). The changes are generally good, but I have a few suggestions for the GEMINI.md file to improve clarity and correctness, particularly around the git command used to generate the diff for analysis. I also noticed that this PR adds configuration files to the root directory, while similar files (gemini-extension.json, GEMINI.md) already exist in the src/ directory. This duplication could lead to confusion and maintainability issues. It would be good to clarify the project structure and remove any redundant files.

[gemini-code-assist]

There is a typo in 'insufficent'. It should be 'insufficient'. In a security context, precision in language is important to avoid any ambiguity.

Suggested change

	* **Weak Cryptographic Algorithms:** Flag any instances of weak or outdated cryptographic algorithms, such as DES, Triple DES, RC4, or ECB mode in block ciphers, or DSA, blowfish, or twofish in asymmetric ciphers. Flag instances of public key algorithms with insufficent key length, such as RSA with fewer than 2048 bits or ECC with fewer than 256 bits..
	* **Weak Cryptographic Algorithms:** Flag any instances of weak or outdated cryptographic algorithms, such as DES, Triple DES, RC4, or ECB mode in block ciphers, or DSA, blowfish, or twofish in asymmetric ciphers. Flag instances of public key algorithms with insufficient key length, such as RSA with fewer than 2048 bits or ECC with fewer than 256 bits..

[gemini-code-assist]

There's a formatting error in this heading. The trailing ** is invalid for a heading and will likely cause rendering issues.

Suggested change

	### Newly Introduced Vulnerabilities**
	### Newly Introduced Vulnerabilities