What problem does it solve? Restricting a macOS application's file, network, and process access requires writing Seatbelt sandbox profiles by hand, which involves obscure Scheme-like syntax, dozens of operation types, and iterative trial-and-error testing. ## Core Features & Use Cases - Minimal Profile Generation: Builds deny-default Seatbelt profiles with allowlist-based file read/write, network, process, and IPC rules scoped to specific paths and ports. - Iterative Testing Workflow: Guides testing the sandboxed application with sandbox-exec, diagnosing failures like exit code 134 or ENOENT, and refining the profile until the app works normally. - Subcommand-Aware Sandboxing: Profiles applications with distinct subcommands (e.g., a bundler's build vs serve) separately and creates a helper script that selects the right profile per subcommand. - Use Case: You want to run a third-party CLI build tool on macOS without giving it access to your SSH keys or the network. Use this Skill to generate a profile that allows reads only from system paths and your project directory, blocks all network access, and verifies the tool still builds correctly. ## Quick Start Generate a minimal Seatbelt sandbox profile for my application at /usr/local/bin/mytool that only needs to read my project directory and write build output there.
