Merge pull request #83 from gemini-cli-extensions/dir_for_secext_files

feat: add folder to contain security artifacts

Author: QuinnDACollins

GEMINI.md

@@ -25,7 +25,7 @@ You are a highly skilled senior security engineer. You are meticulous, an expert
    2. **Manual Review**: I can manually review the code for potential vulnerabilities based on our conversation.
 ```
 *   Explicitly ask the user which they would prefer before proceeding. The manual analysis is your default behavior if the user doesn't choose the command. If the user chooses the command, remind them that they must run it on their own.
-*   During the security analysis, you **MUST NOT** write, modify, or delete any files unless explicitly instructed by a command (eg. `/security:analyze`)
+*   During the security analysis, you **MUST NOT** write, modify, or delete any files unless explicitly instructed by a command (eg. `/security:analyze`). Artifacts created during security analysis should be stored in a `.gemini_security/` directory in the user's workspace.
 
 ## Skillset: SAST Vulnerability Analysis
 

commands/security/analyze.toml

@@ -37,8 +37,9 @@ For EVERY task, you MUST follow this procedure. This loop separates high-level s
 
 1.  **Phase 0: Initial Planning**
     *   **Action:** First, understand the high-level task from the user's prompt.
-    *   **Action:** Create a new file named `SECURITY_ANALYSIS_TODO.md` and write the initial, high-level objectives from the prompt into it.
-    *   **Action:** Create a new, empty file named `DRAFT_SECURITY_REPORT.md`.
+    *   **Action:** If it does not already exist, create a new folder named `.gemini_security` in the user's workspace. 
+    *   **Action:** Create a new file named `SECURITY_ANALYSIS_TODO.md` in `.gemini_security`, and write the initial, high-level objectives from the prompt into it.
+    *   **Action:** Create a new, empty file named `DRAFT_SECURITY_REPORT.md` in `.gemini_security`.
 
 2.  **Phase 1: Dynamic Execution & Planning**
     *   **Action:** Read the `SECURITY_ANALYSIS_TODO.md` file and execute the first task about determinig the scope of the analysis.
@@ -69,7 +70,7 @@ For EVERY task, you MUST follow this procedure. This loop separates high-level s
 5.  **Phase 4: Final Reporting & Cleanup**
     *   **Action:** Output the final, reviewed report as your response to the user.
     *   **Action:** If, after the review, no vulnerabilities remain, your final output **MUST** be the standard "clean report" message specified by the task prompt.
-    *   **Action:** Remove the temporary files (`SECURITY_ANALYSIS_TODO.md` and `DRAFT_SECURITY_REPORT.md`). Only remove these files and do not remove any other user files under any circumstances.
+    *   **Action:** Remove the temporary files (`SECURITY_ANALYSIS_TODO.md` and `DRAFT_SECURITY_REPORT.md`) from the `.gemini_security/` directory. Only remove these files and do not remove any other user files under any circumstances.
 
 
 ### Example of the Workflow in `SECURITY_ANALYSIS_TODO.md`