Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Based on SOC occupation classification
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/FlorianBruniaux/claude-code-ultimate-guide --skill sandbox-statusThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Showing SKILL.md
Comprehensive security audit with scored posture assessment
Quick configuration security check against known threats database
Delegate threat-intelligence research and updates to AgentSec, then validate the guide and landing mirrors.
| name | sandbox-status |
| description | Display native sandbox status, configuration, and recent violations |
| effort | low |
| when_to_use | Use to check whether Claude Code sandbox mode is active and what restrictions apply. |
| disable-model-invocation | true |
Inspect the native Claude Code sandbox state, active configuration, and security events.
/sandbox-status
Check sandbox availability
Show active configuration
List recent sandbox violations
dangerouslyDisableSandbox)#!/bin/bash
echo "=== Native Sandbox Status ==="
echo
# 1. Platform Check
echo "Platform:"
case "$OSTYPE" in
darwin*)
echo " ✅ macOS (Seatbelt built-in)"
;;
linux*)
if which bubblewrap >/dev/null 2>&1; then
echo " ✅ Linux (bubblewrap installed)"
bubblewrap --version 2>/dev/null | head -1
else
echo " ❌ Linux (bubblewrap NOT installed)"
echo " Install: sudo apt-get install bubblewrap socat"
fi
if which socat >/dev/null 2>&1; then
echo " ✅ socat installed"
else
echo " ❌ socat NOT installed"
fi
;;
*)
echo " ❌ Unsupported platform: $OSTYPE"
;;
esac
echo
# 2. Configuration
echo "Configuration (from settings.json):"
if [ -f .claude/settings.json ]; then
CONFIG=".claude/settings.json"
elif [ -f ~/.claude/settings.json ]; then
CONFIG="~/.claude/settings.json"
CONFIG=
[ -n ];
AUTO_ALLOW=$(jq -r 2>/dev/null)
ESCAPE=$(jq -r 2>/dev/null)
WRITE_PATHS=$(jq -r 2>/dev/null | )
CRED_FILES=$(jq -r 2>/dev/null | )
STRICT=$(jq -r 2>/dev/null)
DOMAINS=$(jq -r 2>/dev/null | -3 | )
DOMAINS_COUNT=$(jq -r 2>/dev/null)
[ -n ];
EXCLUDED=$(jq -r 2>/dev/null | )
npx >/dev/null 2>&1;
=== Native Sandbox Status ===
Platform:
✅ macOS (Seatbelt built-in)
Configuration (from settings.json):
Source: .claude/settings.json
Auto-allow: true
dangerouslyDisableSandbox allowed: false
Allowed writes: ${CWD}, /tmp
Denied credential files: ~/.ssh, ~/.aws, ~/.gnupg
Strict allowlist: not set (default false)
Allowed domains: api.anthropic.com, registry.npmjs.com, github.com... (9 total)
Excluded commands: docker, kubectl, podman
Recent sandbox violations:
ℹ️ Log inspection not yet implemented
Tip: Check Claude Code session logs for sandbox violation notifications
Open-Source Runtime:
✅ npx available - can use @anthropic-ai/sandbox-runtime
Usage: npx @anthropic-ai/sandbox-runtime <command>
Documentation:
Guide: guide/security/sandbox-native.md
Official: https://code.claude.com/docs/en/sandboxing
Runtime: https://github.com/anthropic-experimental/sandbox-runtime