AI SECURITYLABS

Security for Gemini Development: Check a repository before you trust it

Part 11 of 16

Check a repository before you trust it

Trusting a folder lets its .gemini/settings.json override yours, its .env set Gemini CLI variables, and its MCP servers and hooks start. Before trusting a repository you didn’t create:

  • Read .gemini/settings.json and stop at anything that turns the sandbox off, allows tools, adds hooks or marks an MCP server "trust": true.
  • Check the project .env for GEMINI_* variables: a trusted folder’s .env can set GEMINI_SANDBOX=false.
  • Read GEMINI.md and AGENTS.md, and check them for hidden Unicode.
  • List every symlink, and re-clone repositories that arrived with their own .git/config.