Move two step workflow to analyze.toml - #45
Conversation
heltonduarte
left a comment
heltonduarte
left a comment
There was a problem hiding this comment.
Please wait for Rishabh's review.
…e written through the prompting in our gemini.md
|
Tested against ~10 repos from our dataset. Directives such as 'Any vulnerabilities?', 'Are there security issues in my code?' will lead to a generic scan using gemini-cli read-file and search-text tools, with a recommendation to use security:analyze for a fuller analysis. |
| * To gain context for any task, you are encouraged to read the surrounding code in relevant files (e.g., utility functions, parent components) as required. | ||
| * You **MUST** only use read-only tools like `ls -R`, `grep`, and `read-file` for the security analysis. | ||
| * During the security analysis, you **MUST NOT** write, modify, or delete any files unless explicitly instructed by the Core Operational Loop (i.e., `SECURITY_ANALYSIS_TODO.md`, `DRAFT_SECURITY_REPORT.md`). | ||
| * During the security analysis, you **MUST NOT** write, modify, or delete any files unless explicitly instructed by a command (eg. `security:analyze`) |
|
I particularly like the suggestion to use /security:analyze at the end. |
…to use command or manual security auditing
|
Moved the suggestion to before the analysis happens (premable). Please review the gemini md and see the changes- had to add a bit to get it working across several repos with proper suggestions. |
|
Looks good to me! |
5 participants
moves the two step flow to the analyze toml in order to reduce accidental triggers of our workflow