How do I install the Web Sandbox skill?

Run npx skillmds@latest add antoniocascais/web-sandbox in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Sandbox safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Sandbox?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Sandbox free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Sandbox?

antoniocascais (@antoniocascais) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Sandbox by antoniocascais — Agent Skill

Name: Web Sandbox
Rating: 4.2 (5 reviews)
Author: antoniocascais

Web Sandbox

Runs web searches and page fetches inside an isolated Docker container instead of on the host, so browsing untrusted pages can't touch your machine and every query/URL is logged. Use when the user wants to search the web, research a topic online, fetch or read web pages, or asks for sandboxed, isolated, or contained web access. Requires a one-time build; reuses your existing host Claude login (mounted read-only). The container runs the official Claude Code CLI headless on Sonnet.

File contents

web-sandbox

Web search/fetch runs inside a throwaway Docker container running the official Claude Code CLI headless. The host never fetches untrusted pages — a prompt injection in a fetched page is trapped in the container and destroyed on make stop. Each search's full transcript (queries + fetched URLs + prompts) is teed to logs/.

Run all commands from this skill's directory (where this SKILL.md and the Makefile live). Run make targets directly — do not pipe them.

Always drive this through make, never raw docker. Raw docker build/ run/exec/rm are deny-listed in settings and can't be approved. The Makefile wraps every docker call, so the permission matcher sees make <target> (allowed) instead of the denied docker command underneath. This is by design — make is the only supported entrypoint.

One-time setup

make build — build the image.
Be logged in on the host (claude → /login if not). make start mounts your existing ~/.claude/.credentials.json read-only into the container — no token or .env step, and no rebuild when the token rotates.

Per-session lifecycle

make start — boot the sandbox (runs as a daemon).
make status — check if it's up.
make stop — tear it down when web work is done.

Searching

When the user wants something searched or fetched, DO NOT use the host WebSearch/WebFetch tools. Instead run:

make search Q="the search query or question"

It prints the answer to stdout — use that in the reply. The container decides which pages to fetch, and those fetches happen in the container, not the host. Override the model with MODEL=opus if needed.

If a search reports the sandbox isn't running, run make start first — but if the user hasn't opted into starting containers this session, ask before doing so.

Audit

make audit — print the search queries and fetched URLs from the latest search.
Full transcripts live in logs/search-<timestamp>.jsonl.

Notes

WebSearch is server-side (Anthropic runs it); only WebFetch's page GETs leave the container. The logs/ transcript captures both queries and fetched URLs, which is more complete than a network tap could be.
The sandbox is restricted to WebSearch + WebFetch; Bash and file tools are denied so it can't fetch around the audit or reach anything else.

---name: web-sandboxdescription: Runs web searches and page fetches inside an isolated Docker container instead of on the host, so browsing untrusted pages can't touch your machine and every query/URL is logged. Use when the user wants to search the web, research a topic online, fetch or read web pages, or asks for sandboxed, isolated, or contained web access. Requires a one-time build; reuses your existing host Claude login (mounted read-only). The container runs the official Claude Code CLI headless on Sonnet.---# web-sandboxWeb search/fetch runs inside a throwaway Docker container running the officialClaude Code CLI headless. The host never fetches untrusted pages — a promptinjection in a fetched page is trapped in the container and destroyed on`make stop`. Each search's full transcript (queries + fetched URLs + prompts)is teed to `logs/`.Run all commands from this skill's directory (where this `SKILL.md` and the`Makefile` live). Run `make` targets directly — do not pipe them.**Always drive this through `make`, never raw `docker`.** Raw `docker build`/`run`/`exec`/`rm` are deny-listed in settings and can't be approved. TheMakefile wraps every docker call, so the permission matcher sees `make <target>`(allowed) instead of the denied docker command underneath. This is by design —`make` is the only supported entrypoint.## One-time setup1. `make build` — build the image.2. Be logged in on the host (`claude` → `/login` if not). `make start` mounts your existing `~/.claude/.credentials.json` read-only into the container — no token or `.env` step, and no rebuild when the token rotates.## Per-session lifecycle- `make start` — boot the sandbox (runs as a daemon).- `make status` — check if it's up.- `make stop` — tear it down when web work is done.## SearchingWhen the user wants something searched or fetched, DO NOT use the hostWebSearch/WebFetch tools. Instead run:```make search Q="the search query or question"```It prints the answer to stdout — use that in the reply. The container decideswhich pages to fetch, and those fetches happen in the container, not the host.Override the model with `MODEL=opus` if needed.If a search reports the sandbox isn't running, run `make start` first — but ifthe user hasn't opted into starting containers this session, ask before doing so.## Audit- `make audit` — print the search queries and fetched URLs from the latest search.- Full transcripts live in `logs/search-<timestamp>.jsonl`.## Notes- WebSearch is server-side (Anthropic runs it); only WebFetch's page GETs leave the container. The `logs/` transcript captures both queries and fetched URLs, which is more complete than a network tap could be.- The sandbox is restricted to WebSearch + WebFetch; Bash and file tools are denied so it can't fetch around the audit or reach anything else.

Frequently asked questions