Claude Sandbox Zsh — Development skill for Claude Code

Claude Code sandbox for macOS

A security wrapper for [Claude Code](https://github.com/anthropic-ai/claude-code) that runs the CLI inside macOS's `sandbox-exec`. The sandbox grants read/write acess only to your current project directory (plus the system temp dir) while allowing just enough extra permissions for Claude Code to work smoothly.

[!WARNING] **Heads-up**: `sandbox-exec` is deprecated in macOS 14 (Sonoma), but still functional as of June 2025 in macOS 15 (Sequoia). Apple may remove it in a future release.

Demo

[](https://asciinema.org/a/cmbhNcAOiNjrfWcLiqdUa36q0)

Overview

This tool provides additional security when running Claude Code with permission skipping enabled (`--dangerously-skip-permissions`). It creates a sandbox that:

• ✅ Allows full file access to your current project directory
• ✅ Allows reading system files needed for execution
• ✅ Allows network access (for the Claude API, but also for anything else!)
• ❌ Blocks access to your Documents, Desktop, Downloads, and other personal folders
• ❌ Blocks access to sensitive config files like .ssh, .aws, etc.

Why Use This?

Claude Code is an AI coding assistant that can read and write files and access the internet, etc. When you skip permission prompts for convenience, you're trusting it with full file system access. This sandbox adds a safety layer by restricting access to only the files you're actually working on or need to read/exec from the system. (Or at least attempts to! It's default deny, but I may have written the sandbox profile wrong.)

The goal here is to prevent some damaging footguns, while acknowledging there are [other risks](https://simonwillison.net/series/prompt-injection/) associated with using LLMs as agents that are out of scope for this approach.

Installation

1. Download the claude-sandbox script to a directory in your PATH (e.g., ~/.local/bin/):

   curl -o ~/.local/bin