Google Gemini CLI for second opinions, architectural advice, code reviews, security audits. Leverage 1M+ context for comprehensive codebase analysis via command-line tool.
npx skills add https://github.com/secondsky/claude-skills --skill gemini-cli
Leverage Gemini's 1M+ context window as your AI pair programmer within Claude Code workflows.
This skill teaches Claude Code how to use the official Google Gemini CLI (gemini command) to get second opinions, architectural advice, debugging help, and comprehensive code reviews. Based on production testing with the official CLI tool.
Prerequisites:
bun add -g @google/gemini-cli)gemini once to authenticate)Core Command Patterns:
# Quick question (non-interactive with -p flag)
gemini -p "Should I use D1 or KV for session storage?"
# Code review with file context
cat src/auth.ts | gemini -p "Review this authentication code for security vulnerabilities"
# Architecture advice using Pro model
gemini -m gemini-2.5-pro -p "Best way to handle WebSockets in Cloudflare Workers?"
# With all files in directory
gemini --all-files -p "Review this auth implementation for security issues"
# Interactive mode for follow-up questions
gemini -i "Help me debug this authentication error"
Critical: Always use -p flag for non-interactive commands in automation/scripts.
Claude Code should automatically invoke Gemini in these situations:
gemini -m gemini-2.5-pro -p "[architectural question]"cat [security-file] | gemini -m gemini-2.5-pro -p "Security audit this code"gemini -p "Help debug: [error message]" < error.loggemini --all-files -m gemini-2.5-pro -p "Review this refactoring plan"cat large-file.ts | gemini -p "Analyze this code structure"bun add -g @google/gemini-cli
gemini
Follow the authentication prompts to link your Google account.
gemini --version # Should show 0.13.0+
gemini -p "What is 2+2?" # Test connection
gemini -m gemini-2.5-flash -p "Review this function for performance issues"
gemini -m gemini-2.5-pro -p "Security audit this authentication system"
Quick question? → Flash
Security/architecture? → Pro
Debugging? → Flash (try Pro if stuck)
Refactoring 5+ files? → Pro
CRITICAL FINDING: Flash and Pro can give opposite recommendations on the same question (both valid, different priorities). Flash prioritizes performance, Pro prioritizes consistency/correctness. For details, load references/models-guide.md.
# Audit authentication code
cat src/middleware/auth.ts | gemini -m gemini-2.5-pro -p "
Security audit this authentication middleware. Check for:
1. Token validation vulnerabilities
2. Timing attack risks
3. Error handling leaks
4. CSRF protection
5. Rate limiting
"
# Compare technologies with context
gemini -m gemini-2.5-pro -p "
Context: Building Cloudflare Worker with user authentication.
Question: Should I use D1 or KV for storing session data?
Considerations:
1. Session reads on every request
2. TTL-based expiration
3. Cost under 10M requests/month
4. Deployment complexity
"
# Analyze error logs with context
tail -100 error.log | gemini -p "
These errors started after deploying auth changes. What's the likely root cause?
Context:
- Added JWT validation middleware
- Using @cloudflare/workers-jwt
- Errors only on /api/* routes
"
For more use cases: Load references/models-guide.md for performance optimization, refactoring plans, and code reviews.
Scenario: User asks architectural question
User: "Should I use D1 or KV for storing user sessions?"
Claude (internal): This is an architectural decision. Consult Gemini for second opinion.
[Runs: gemini -m gemini-2.5-pro -p "Compare D1 vs KV for user session storage in Cloudflare Workers. Consider: read/write patterns, cost, performance, complexity."]
Claude (to user): "I've consulted Gemini for a second opinion. Here's what we both think:
My perspective: [Claude's analysis]
Gemini's perspective: [Gemini's analysis]
Key differences: [synthesis]
Recommendation: [combined recommendation]"
Key Pattern: Synthesize both perspectives, don't just forward Gemini's response.
Error: Error: Not authenticated
Solution:
gemini # Follow authentication prompts
Error: Error: Model not found: gemini-2.5-flash-lite
Cause: Model deprecated or renamed (flash-lite doesn't exist)
Solution: Use stable models only:
gemini -m gemini-2.5-flash -p "Your question"
gemini -m gemini-2.5-pro -p "Your question"
Cause: Interactive mode when expecting non-interactive
Solution: Always use -p flag for non-interactive commands
# ✅ Correct
gemini -p "Question"
# ❌ Wrong (will hang waiting for input)
gemini "Question"
For more troubleshooting: Load references/models-guide.md for rate limits, large file context issues, and performance tips.
Load reference files in these scenarios:
references/models-guide.md when:references/prompting-strategies.md when:references/gemini-experiments.md when:Note: helper-functions.md is obsolete (references old gemini-coach wrapper, not the official gemini CLI).
-p for Automation# ✅ Good for scripts
gemini -p "Question"
# ❌ Bad (interactive)
gemini
# Architecture/security → Pro
gemini -m gemini-2.5-pro -p "[critical question]"
# Debugging/review → Flash
gemini -m gemini-2.5-flash -p "[general question]"
# ✅ Good: Context + Question + Considerations
gemini -p "Context: Building Cloudflare Worker. Question: Best auth pattern? Considerations: 1) Stateless, 2) JWT, 3) <100ms overhead"
# ❌ Bad: Vague
gemini -p "Best auth?"
# ✅ Efficient
cat src/auth.ts | gemini -p "Review for security"
# ❌ Less efficient
gemini -p "Review src/auth.ts"
❌ BAD: Just paste Gemini's response
Claude: [runs gemini] "Gemini says: [paste]"
✅ GOOD: Synthesize both perspectives
Claude: "I've consulted Gemini for a second opinion:
My analysis: [Claude's perspective]
Gemini's analysis: [Gemini's perspective]
Key differences: [synthesis]
Recommendation: [unified answer]"
if output=$(gemini -p "Question" 2>&1); then
echo "Gemini says: $output"
else
echo "Gemini consultation failed, proceeding with Claude's recommendation"
fi
2.1.0 (2025-12-15):
2.0.0 (2025-11-13):
gemini CLI v0.13.0+1.0.0 (2025-11-08):
MIT - See LICENSE
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth providers (Google, GitHub, Discord, etc.), two-factor authentication (TOTP, SMS), passkeys/WebAuthn support, session management, role-based access control (RBAC), rate limiting, and database adapters. Use when adding authentication to applications, implementing OAuth flows, setting up 2FA/MFA, managing user sessions, configuring authorization rules, or building secure authentication systems for web applications.
Package entire code repositories into single AI-friendly files using Repomix. Capabilities include pack codebases with customizable include/exclude patterns, generate multiple output formats (XML, Markdown, plain text), preserve file structure and context, optimize for AI consumption with token counting, filter by file types and directories, add custom headers and summaries. Use when packaging codebases for AI analysis, creating repository snapshots for LLM context, analyzing third-party libraries, preparing for security audits, generating documentation context, or evaluating unfamiliar codebases.
You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.
Expert patterns for HubSpot CRM integration including OAuth authentication, CRM objects, associations, batch operations, webhooks, and custom objects. Covers Node.js and Python SDKs.
Perform language and framework specific security best-practice reviews and suggest improvements. Use when the user explicitly requests security best practices guidance, a security review or report, or secure-by-default coding help. Supports Python, JavaScript/TypeScript, and Go. Do NOT use for general code review, debugging, threat modeling (use security-threat-model), or non-security tasks.
Configures API gateways for routing, authentication, rate limiting, and request transformation in microservice architectures. Use when setting up Kong, Nginx, AWS API Gateway, or Traefik for centralized API management.
Take secondsky/gemini-cli from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.