How to use it
- Once at setup, work through sections A to G.
- Fix every P1 item before doing any work on company code. P2 items close important gaps; P3 items are good practice.
- Items with an audit check ID are verified automatically by the Gemini Security Audit. Re-run it monthly and after every upgrade. Items without one are confirmed by hand.
- Keep the completed checklist with your saved audit report as your assessment record.
A. Installation and identity
| # | Check | Priority | Audit check |
|---|---|---|---|
| A1 | Gemini CLI is 0.39.1 or later (CVE-2026-12537), and the Code Assist extension is current. | P1 | I01 |
| A2 | Work runs under your organisation's Code Assist Standard or Enterprise licence, so its admin controls apply. | P1 | manual |
| A3 | On Windows, C:\ProgramData\gemini-cli exists and only administrators can write it. | P1 | W01, W02 |
B. Sandbox, trust and approvals
| # | Check | Priority | Audit check |
|---|---|---|---|
| B1 | Sandboxing is on (tools.sandbox or security.toolSandboxing), with a strict Seatbelt profile or a container on macOS. | P1 | G02 |
| B2 | Folder trust is on (security.folderTrust.enabled). | P1 | G03 |
| B3 | security.disableYoloMode is true. | P2 | G04 |
| B4 | general.defaultApprovalMode is "default", not auto_edit. | P2 | G05 |
| B5 | tools.allowed lists only read-only commands, never the bare run_shell_command. | P1 | G06 |
| B6 | The sandbox has no network access, and approvals don't last across sessions. | P2 | G07, G08 |
| B7 | Gemini Code Assist geminicodeassist.agentYoloMode is off. | P1 | C01 |
C. Policies and hooks
| # | Check | Priority | Audit check |
|---|---|---|---|
| C1 | Policy rules in ~/.gemini/policies/ deny destructive commands and ask before pushes and network commands. | P2 | R01 |
| C2 | No policy rule allows run_shell_command without a narrow commandPrefix. | P1 | R01 |
| C3 | No hook downloads or runs remote code. | P1 | H01 |
| C4 | No alias or export adds --yolo, --skip-trust, GEMINI_SANDBOX=false or GEMINI_CLI_TRUST_WORKSPACE=true. | P1 | S01 |
D. Extensions: MCP servers and extensions
| # | Check | Priority | Audit check |
|---|---|---|---|
| D1 | Every MCP server is approved and pinned to a version. | P1 | M01, M03 |
| D2 | No MCP server has "trust": true. | P1 | M04 |
| D3 | Servers that read content outsiders write have read-only scopes, and their secrets come from environment variables. | P2 | M02, M05 |
| D4 | Extensions are restricted with security.allowedExtensions or blockGitExtensions, and each installed one is reviewed. | P2 | G09, E01, E02 |
E. Repositories
| # | Check | Priority | Audit check |
|---|---|---|---|
| E1 | Before trusting a folder, its .gemini/settings.json is read for sandbox, allowed tools, hooks and trusted MCP servers. | P1 | P01, P02, P03, P04, P05, P06, P07 |
| E2 | The project .env sets no GEMINI_* variables such as GEMINI_SANDBOX. | P1 | P08 |
| E3 | GEMINI.md and AGENTS.md are read and checked for hidden Unicode. | P1 | P09, P10 |
| E4 | Symlinks are listed and none points at .gemini/ or a dotfile. | P1 | P13 |
| E5 | Repositories that arrive with their own .git/config are checked for program-running keys. | P2 | P14 |
| E6 | .env files are gitignored. | P2 | P12 |
F. GitHub Actions
| # | Check | Priority | Audit check |
|---|---|---|---|
| F1 | run-gemini-cli is 0.1.22 or later and pinned by commit SHA. | P1 | P11 |
| F2 | Workflows never run Gemini with --yolo on issues or pull requests from outsiders. | P1 | P11 |
| F3 | Workflows hold only the permissions and secrets they need. | P1 | manual |
G. Working habits
| # | Check | Priority | Audit check |
|---|---|---|---|
| G1 | Instruction-like text in issues, pull requests, READMEs and web pages is read by a person before Gemini acts on it. | P1 | manual |
| G2 | Changes to .gemini/, GEMINI.md and workflows are treated as security events. | P1 | manual |
| G3 | No production credentials in the environment Gemini runs in. | P1 | manual |
| G4 | Suspicious agent behaviour is reported to the security team the same day. | P2 | manual |
Sources
- Gemini CLI and Code Assist documentation: Configuration reference, Sandboxing, Trusted folders, Policy engine, MCP servers, Hooks, Code Assist agent mode, Google: transition to Antigravity CLI.
- Incidents behind sections E and F: see the Common Gemini Misconfigurations.
Informational only, with no guarantee of a vulnerability-free setup, so test every configuration in your own environment. AISecurityLabs.org is independent and not affiliated with Google. Settings change as Gemini CLI evolves, so check them against the reference for your version.