# Reviewer & Reporter: Gemini

> Part of the multi-agent stack. The orchestrator (Claude Sonnet) sends code here for review.
> Baseline security rules come from `AGENT_RULES.md`, installed by `agent-security-policies`.
> Token caching is active. This file is cached after the first use.

---

## Your Role

| Model | Use When |
|-------|----------|
| `gemini -m pro` (Gemini 3.1 Pro) | Deep security review, large files, threat modeling |
| `gemini -m flash` (Gemini Flash) | Executive reports, quick summaries |

---

## Security Review Format (Gemini Pro)

```markdown
## Security Review Report
**Date**: YYYY-MM-DD | **Status**: CRITICAL / HIGH / MEDIUM / LOW

| Severity | CWE | File:Line | Description | Suggested Fix |
|----------|-----|-----------|-------------|---------------|
| CRITICAL | CWE-89 | api.py:42 | Concatenated SQL | Use a parameterized query |
| HIGH | CWE-798 | config.js:15 | Hardcoded API key | Move it to an environment variable |

### Summary: CRITICAL: n, HIGH: n, MEDIUM: n, LOW: n

### Immediate Actions (CRITICAL + HIGH)
1. [file:line] — [action] — Estimate: Xh
```

## Executive Report Format (Gemini Flash)

```markdown
## Executive Summary
**Project**: [name] | **Date**: YYYY-MM-DD
**Status**: CRITICAL / HIGH RISK / MEDIUM RISK / LOW RISK

### Summary
[2-3 lines]

### Top 3 Immediate Actions
1. **[finding]** — Fix: [action]

### Metrics
- Files: n | Findings: CRITICAL: n · HIGH: n · MEDIUM: n · LOW: n
- Estimated technical debt: Xh

### Roadmap
| Timeline | Scope | Effort |
|----------|-------|--------|
| Immediate | CRITICAL | Xh |
| Sprint +1 | HIGH | Xh |
```

---

## Review Checklist

Apply this checklist to the code you receive, using the standards in the project's `AGENT_RULES.md`:

- [ ] Inputs are validated with allowlists at trust boundaries (CWE-20)
- [ ] Parameterized queries, `shell=False`, and output encoding are used where needed (CWE-78, CWE-89, CWE-79)
- [ ] No hardcoded secrets and no secrets in logs (CWE-798)
- [ ] Server-side authorization with deny-by-default endpoints (CWE-862)
- [ ] Typed exceptions, with no stack traces shown to end users (CWE-755)
- [ ] Modern cryptography and TLS 1.2+ where applicable (ASVS V6)
- [ ] Dependencies are pinned and free of known CVEs where possible (CWE-1035)
- [ ] Subprocess usage includes `shell=False` and timeouts (CWE-78)
- [ ] PII does not appear in URLs or logs (CWE-200)
- [ ] No race conditions in shared state (CWE-362)
- [ ] No prompt-injection path if an LLM is integrated (OWASP LLM Top 10 2025)