# Install Container Security (Snyk) in Google Antigravity

Source: https://github.com/snyk/studio-recipes/tree/main/command_directives/synchronous_remediation/skills/container-security
Listing: https://www.antigravityskills.org/skill/container-security
Safety review (2026-10-14): Instruction-only Snyk skill (3 Markdown files, no scripts); it needs a Snyk login, sends image scans to Snyk through npx snyk@latest, and may edit Dockerfiles and run docker builds.

## Rules for the agent
- Before running anything, tell the user what you will download and whether it contains scripts, and ask them to confirm.
- Install into this project (.agents/skills/) unless the user asks for a global install (~/.gemini/config/skills/).
- Do not run other commands from the source repository unless the user asks.

## Steps
1. Download the repository

```bash
git clone --depth 1 https://github.com/snyk/studio-recipes /tmp/studio-recipes && git -C /tmp/studio-recipes log -1 --format=%h
```

   We reviewed commit 691f03c. If the second command prints a different hash, the skill may have changed since our review.
2. Copy the skill into this project (workspace skill)

```bash
mkdir -p .agents/skills && cp -r /tmp/studio-recipes/command_directives/synchronous_remediation/skills/container-security .agents/skills/
```

   Run from your project root. Antigravity reads workspace skills from .agents/skills/<folder>/; the folder holds SKILL.md and references/ (3 Markdown files, no scripts).
3. Or install it for all projects (global skill)

```bash
mkdir -p ~/.gemini/config/skills && cp -r /tmp/studio-recipes/command_directives/synchronous_remediation/skills/container-security ~/.gemini/config/skills/
```

   Use this instead of the previous step. For the Antigravity CLI the global folder is ~/.gemini/antigravity-cli/skills/.
4. Add the Snyk MCP server to Antigravity

```json
{
  "mcpServers": {
    "Snyk": {
      "command": "npx",
      "args": ["-y", "snyk@latest", "mcp", "-t", "stdio"]
    }
  }
}
```

   This is the repo's mcp/.mcp.json. Put it in ~/.gemini/config/mcp_config.json (all projects) or .agents/mcp_config.json (this project). Needs Node.js for npx. Without the MCP server the skill has no scan tool.
5. Log in to Snyk

```bash
npx -y snyk@latest auth
```

   The README says snyk auth (or set SNYK_TOKEN for non-interactive use). The npx form is our adaptation for machines without a global Snyk CLI.
6. Check that Antigravity sees both
   Antigravity 2.0 app: start a new conversation and ask "What skills do you have?"; container-security should be listed. Antigravity CLI: run /skills (/skills reload in a session that was already open). The Snyk server should appear under Settings > Customizations > Installed MCP Servers.

Note: The studio-recipes README does not mention Antigravity, and Snyk's installer does not install this skill. These steps copy the documented skill folder into Antigravity's standard skill folders and reuse the repo's own MCP config.

Done when the skill is listed: in the Antigravity 2.0 app ask "What skills do you have?" in a new conversation (the app has no /skills command); in the Antigravity CLI run /skills (run /skills reload first in a session that was already open).