Agent Seatbelt — AI skill for Claude Code

agent-seatbelt

Defense-in-depth for AI coding agents on macOS.

• Sandbox (sb) — Apple Seatbelt wrapper that blocks reads of your secrets and writes outside your project, even with --dangerously-skip-permissions. Two files, no dependencies.
• OPF hooks (hooks-opf/) — Userland PII detector powered by `openai/privacy-filter`. Catches secrets and personal data flowing into prompts or out of tool responses before the LLM sees them.

The sandbox is a file-level gate. The hooks are a content-level filter. Each closes a hole the other can't.

Background

I ran Claude Code in unrestricted mode for months. One day it couldn't read an env var, failed a few times, then decided to read `~/.zshrc` to debug. My `.zshrc` had hardcoded API keys. They got sent to Anthropic's servers and logged in local conversation history.

Claude apologized, told me to revoke everything, and suggested better practices. That's nice. But "the AI felt bad about it" isn't a security boundary.

Built-in sandboxes (Claude's `/sandbox`, Codex's approval policies) only gate their own tools. An agent that shells out via Bash or Python bypasses all of it. OS-level enforcement can't be bypassed. The kernel doesn't care what the agent thinks it's allowed to do.

Sandbox (`sb`)

Wraps `sandbox-exec` (Apple's Seatbelt) around your agent so it can't read your secrets or write outside your project, even if you run it with `--dangerously-skip-permissions`.

Install

ln -sf /path/to/agent-seatbelt/sb ~/.local/bin/sb
ln -sf /path/to/agent-seatbelt/my.sb ~/my.sb

Symlinks so edits to the repo are immediately live. No re-copying after updates.

Usage

cd ~/my-project
sb claude --dangerously-skip-permissions
sb npm install
sb bash

# strip secrets from environment variables too
sb -c claude --dangerously-skip-permissions

`-c` / `--clean-env` wipes the environment and passes through only `HOME`, `PATH`, `SHELL`, `TERM`,