Skip to main content Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/FlorianBruniaux/claude-code-plugins --skill sandbox-statusEl comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Más de este repositorio
Autonomous improvement loop: scan codebase metrics, scaffold experiment files, run agent-driven iterations until metric improves
Audit Claude Code agents defined in .claude/agents/ for description specificity, model tier appropriateness, tools scoping, and system prompt quality. Detects dispatch ambiguity between agents, flags over-permissive tool grants, and checks for human-in-the-loop patterns that break programmatic orchestration. Use when onboarding to a project with existing agents, after adding new agents to a fleet, or when an orchestrator consistently selects the wrong agent.
Audit Claude Code hooks defined in settings.json files for validity, performance safety, and correctness. Resolves each command against the filesystem, checks exit-code strategy for blocking hooks, flags missing timeouts, and reviews interactive vs async patterns. Use when setting up hooks for the first time, debugging a hook that never fires or hangs the agent, or doing a periodic hooks hygiene pass.
Ocupaciones relacionadasSOC
Basado en la clasificación ocupacional SOC
| name | sandbox-status |
| description | Display native sandbox status, configuration, and recent violations |
| effort | low |
| when_to_use | Use to check whether Claude Code sandbox mode is active and what restrictions apply. |
| disable-model-invocation | true |
Sandbox Status Command
Inspect the native Claude Code sandbox state, active configuration, and security events.
Usage
/sandbox-status
What It Does
-
Check sandbox availability
- Verify OS primitives installed (bubblewrap on Linux, Seatbelt on macOS)
- Display platform support status
-
Show active configuration
- Sandbox mode (Auto-allow vs Regular permissions)
- Filesystem policies (allowed writes, denied reads)
- Network policies (domain allowlist/denylist)
- Excluded commands
-
List recent sandbox violations
- Blocked filesystem access attempts
- Blocked network connections
- Escape hatch invocations (
dangerouslyDisableSandbox)
Implementation
#!/bin/bash
echo "=== Native Sandbox Status ==="
echo
echo "Platform:"
case "$OSTYPE" in
darwin*)
echo " ✅ macOS (Seatbelt built-in)"
;;
linux*)
if which bubblewrap >/dev/null 2>&1; then
echo " ✅ Linux (bubblewrap installed)"
bubblewrap --version 2>/dev/null | head -1
else
echo " ❌ Linux (bubblewrap NOT installed)"
echo " Install: sudo apt-get install bubblewrap socat"
fi
if which socat >/dev/null 2>&1; then
echo " ✅ socat installed"
else
echo " ❌ socat NOT installed"
fi
;;
*)
echo " ❌ Unsupported platform: $OSTYPE"
;;
esac
echo
echo "Configuration (from settings.json):"
if [ -f .claude/settings.json ]; then
CONFIG=".claude/settings.json"
elif [ -f ~/.claude/settings.json ]; then
CONFIG="~/.claude/settings.json"
CONFIG=
[ -n ];
AUTO_ALLOW=$(jq -r 2>/dev/null)
WRITE_PATHS=$(jq -r 2>/dev/null | )
DENIED_READS=$(jq -r 2>/dev/null | )
NET_POLICY=$(jq -r 2>/dev/null)
DOMAINS=$(jq -r 2>/dev/null | -3 | )
DOMAINS_COUNT=$(jq -r 2>/dev/null)
[ -n ];
EXCLUDED=$(jq -r 2>/dev/null | )
npx >/dev/null 2>&1;
Example Output
=== Native Sandbox Status ===
Platform:
✅ macOS (Seatbelt built-in)
Configuration (from settings.json):
Source: .claude/settings.json
Auto-allow: true
Allowed writes: ${CWD}, /tmp
Denied reads: ${HOME}/.ssh, ${HOME}/.aws, ${HOME}/.kube
Network policy: deny
Allowed domains: api.anthropic.com, registry.npmjs.com, github.com... (9 total)
Excluded commands: docker, kubectl, podman
Recent sandbox violations:
ℹ️ Log inspection not yet implemented
Tip: Check Claude Code session logs for sandbox violation notifications
Open-Source Runtime:
✅ npx available - can use @anthropic-ai/sandbox-runtime
Usage: npx @anthropic-ai/sandbox-runtime <command>
Documentation:
Guide: guide/sandbox-native.md
Official: https://code.claude.com/docs/en/sandboxing
Runtime: https://github.com/anthropic-experimental/sandbox-runtime
Use Cases
- Pre-deployment: Verify sandbox config before running autonomous workflows
- Debugging: Investigate why certain commands are blocked
- Security audit: Review allowed domains and filesystem access
- Onboarding: Help new team members understand project sandbox policy
See Also
else
echo
" ⚠️ No settings.json found"
""
fi
if
"$CONFIG"
then
echo
" Source: $CONFIG"
'.sandbox.autoAllowMode // "not set"'
"$CONFIG"
echo
" Auto-allow: $AUTO_ALLOW"
'.sandbox.filesystem.allowedWritePaths[]? // empty'
"$CONFIG"
tr
'\n'
', '
echo
" Allowed writes: ${WRITE_PATHS:-not set}"
'.sandbox.filesystem.deniedReadPaths[]? // empty'
"$CONFIG"
tr
'\n'
', '
echo
" Denied reads: ${DENIED_READS:-not set}"
'.sandbox.network.policy // "not set"'
"$CONFIG"
echo
" Network policy: $NET_POLICY"
'.sandbox.network.allowedDomains[]? // empty'
"$CONFIG"
head
tr
'\n'
', '
'.sandbox.network.allowedDomains | length'
"$CONFIG"
if
"$DOMAINS"
then
echo
" Allowed domains: $DOMAINS... ($DOMAINS_COUNT total)"
else
echo
" Allowed domains: not set"
fi
'.sandbox.excludedCommands[]? // empty'
"$CONFIG"
tr
'\n'
', '
echo
" Excluded commands: ${EXCLUDED:-not set}"
fi
echo
echo
"Recent sandbox violations:"
echo
" ℹ️ Log inspection not yet implemented"
echo
" Tip: Check Claude Code session logs for sandbox violation notifications"
echo
echo
"Open-Source Runtime:"
if
which
then
echo
" ✅ npx available - can use @anthropic-ai/sandbox-runtime"
echo
" Usage: npx @anthropic-ai/sandbox-runtime <command>"
else
echo
" ⚠️ npx not found (install Node.js)"
fi
echo
echo
"Documentation:"
echo
" Guide: guide/sandbox-native.md"
echo
" Official: https://code.claude.com/docs/en/sandboxing"
echo
" Runtime: https://github.com/anthropic-experimental/sandbox-runtime"
