Seatbelt

Seatbelt Skill

macOS sandbox configuration using Seatbelt (sandbox-exec).

Commands

seatbelt_profile

Generate a Seatbelt profile.

seatbelt_export

Export an SBPL profile to a file.

Quick Usage

# Generate profile with override
nickel export examples/python-script-runner.ncl --field _profile -f text -- \
  --override "home_dir=\"$HOME\"" \
  --override "script_path=\"$HOME/projects/my_script.py\"" \
  > /tmp/profile.sb

# Run in sandbox
sandbox-exec -f /tmp/profile.sb /usr/bin/python3 "$HOME/projects/my_script.py"

Nickel CLI

Basic Export

# Export as text
nickel export config.ncl -f text

# Export specific field
nickel export --field _profile config.ncl -f text

Customize Mode

# List available fields
nickel export config.ncl -- list

# Override values
nickel export config.ncl -f text -- \
  --override "home_dir=\"$HOME\"" \
  --override "script_path=\"$HOME/projects/my_script.py\""

Concepts

Python Sandbox Example

# Generate profile
nickel export examples/python-script-runner.ncl --field _profile -f text -- \
  --override "home_dir=\"$HOME\"" \
  --override "script_path=\"$HOME/projects/my_script.py\"" \
  --override 'python_path="/usr/bin/python3"' \
  > /tmp/profile.sb

# Run
sandbox-exec -f /tmp/profile.sb /usr/bin/python3 "$HOME/projects/my_script.py"

Best Practices

• Use --override to customize paths per user
• Use --field _profile to export only the profile
• Use -f text for sandbox-exec (not JSON)
• Test profiles with sandbox-exec before deployment

Related Skills