Gemini CLI actually had an extension explicitly for security tasks: https://github.com/gemini-cli-extensions/security

But, Gemini CLI is deprecated. So, I tried to use Antigravity and it simply refused.

Weirdly, Gemma 4 has proven to be excellent at this task in subsequent tests. The best in its size/class. So, not everybody at Google is determined to break Google models for security work.