# Seatbelt

> Use when configuring macOS sandbox execution with Seatbelt profiles, generating sandbox-exec profiles, or testing macOS sandbox restrictions.

- Skill: `tao3k/seatbelt` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add tao3k/seatbelt`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tao3k/seatbelt/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tao3k (https://skillmd.com/u/tao3k)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tao3k/seatbelt

---


# Seatbelt Skill

macOS sandbox configuration using Seatbelt (sandbox-exec).

## Commands

| Command | Description |
|---------|-------------|
| [`seatbelt_profile`](#seatbelt_profile) | Generate Seatbelt profile |
| [`seatbelt_export`](#seatbelt_export) | Export SBPL profile to file |

### seatbelt_profile

Generate a Seatbelt profile.

### seatbelt_export

Export an SBPL profile to a file.

## Quick Usage

```bash
# Generate profile with override
nickel export examples/python-script-runner.ncl --field _profile -f text -- \
  --override "home_dir=\"$HOME\"" \
  --override "script_path=\"$HOME/projects/my_script.py\"" \
  > /tmp/profile.sb

# Run in sandbox
sandbox-exec -f /tmp/profile.sb /usr/bin/python3 "$HOME/projects/my_script.py"
```

## Nickel CLI

### Basic Export

```bash
# Export as text
nickel export config.ncl -f text

# Export specific field
nickel export --field _profile config.ncl -f text
```

### Customize Mode

```bash
# List available fields
nickel export config.ncl -- list

# Override values
nickel export config.ncl -f text -- \
  --override "home_dir=\"$HOME\"" \
  --override "script_path=\"$HOME/projects/my_script.py\""
```

## Concepts

| Topic | Description | Reference |
|-------|-------------|-----------|
| Profile Types | Sandbox profiles | [profiles.md](references/profiles.md) |
| SBPL Syntax | SBPL reference | [sbpl-syntax.md](references/sbpl-syntax.md) |
| Path Matching | Path patterns | [path-matching.md](references/path-matching.md) |

## Python Sandbox Example

```bash
# Generate profile
nickel export examples/python-script-runner.ncl --field _profile -f text -- \
  --override "home_dir=\"$HOME\"" \
  --override "script_path=\"$HOME/projects/my_script.py\"" \
  --override 'python_path="/usr/bin/python3"' \
  > /tmp/profile.sb

# Run
sandbox-exec -f /tmp/profile.sb /usr/bin/python3 "$HOME/projects/my_script.py"
```

## Best Practices

- Use `--override` to customize paths per user
- Use `--field _profile` to export only the profile
- Use `-f text` for sandbox-exec (not JSON)
- Test profiles with `sandbox-exec` before deployment

## Related Skills

| Topic | Description | Reference |
|-------|-------------|-----------|
| Nsjail | Linux sandboxing | [nsjail](../nsjail/SKILL.md) |