seatbelt

kind	SKILL.md
type	skill
title	Seatbelt Sandbox
category	security
tags	["seatbelt","sandbox","macos"]
name	seatbelt
description	Use when configuring macOS sandbox execution with Seatbelt profiles, generating sandbox-exec profiles, or testing macOS sandbox restrictions.
author	xiuxian-artisan-workshop
date	2026-04-26T09:30-07:00
metadata	{"retrieval":{"saliency_base":5.5,"decay_rate":0.05},"version":"1.1.0","source":"https://github.com/tao3k/xiuxian-artisan-workshop/tree/main/packages/ncl/sandbox/seatbelt","routing_keywords":["seatbelt","sandbox-exec","macos","sandbox","apple","darwin","sbpl","entitlements","mac"]}

Seatbelt Skill

macOS sandbox configuration using Seatbelt (sandbox-exec).

Commands

Command	Description
seatbelt_profile	Generate Seatbelt profile
seatbelt_export	Export SBPL profile to file

seatbelt_profile

Generate a Seatbelt profile.

seatbelt_export

Export an SBPL profile to a file.

Quick Usage

# Generate profile with override
nickel export examples/python-script-runner.ncl --field _profile -f text -- \
  --override "home_dir=\"$HOME\"" \
  --override "script_path=\"$HOME/projects/my_script.py\"" \
  > /tmp/profile.sb

# Run in sandbox
sandbox-exec -f /tmp/profile.sb /usr/bin/python3 "$HOME/projects/my_script.py"

Nickel CLI

Basic Export

# Export as text
nickel export config.ncl -f text

# Export specific field
nickel export --field _profile config.ncl -f text

Customize Mode

# List available fields
nickel export config.ncl -- list

# Override values
nickel export config.ncl -f text -- \
  --override "home_dir=\"$HOME\"" \
  --override "script_path=\"$HOME/projects/my_script.py\""

Concepts

Topic	Description	Reference
Profile Types	Sandbox profiles	profiles.md
SBPL Syntax	SBPL reference	sbpl-syntax.md
Path Matching	Path patterns	path-matching.md

Python Sandbox Example

# Generate profile
nickel export examples/python-script-runner.ncl --field _profile -f text -- \
  --override "home_dir=\"$HOME\"" \
  --override "script_path=\"$HOME/projects/my_script.py\"" \
  --override 'python_path="/usr/bin/python3"' \
  > /tmp/profile.sb

# Run
sandbox-exec -f /tmp/profile.sb /usr/bin/python3 "$HOME/projects/my_script.py"

Best Practices

• Use --override to customize paths per user
• Use --field _profile to export only the profile
• Use -f text for sandbox-exec (not JSON)
• Test profiles with sandbox-exec before deployment

Related Skills

Topic	Description	Reference
Nsjail	Linux sandboxing	nsjail