sandbox-entitlements-auditor
Audit and recommend minimal sandbox entitlements for secure desktop applications
npx skills add a5c-ai/babysitter --skill sandbox-entitlements-auditor --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# sandbox-entitlements-auditor Audit existing entitlements and recommend minimal sandbox permissions for secure desktop applications, primarily for macOS but applicable concepts for other platforms. ## Capabilities - Analyze current entitlements usage - Detect over-permissioned configurations - Recommend minimal entitlement sets - Check for security anti-patterns - Verify MAS compliance - Generate audit reports ## Input Schema ```json { "type": "object", "properties": { "projectPath": { "type": "string" }, "entitlementsPath": { "type": "string" }, "targetDistribution": { "enum": ["mas", "direct", "both"] } }, "required": ["projectPath"] } ``` ## Audit Checks - Unnecessary file system access - Broad network permissions when not needed - Hardened runtime exceptions - JIT compilation allowance - Library validation disabling ## Related Skills - `macos-entitlements-generator` - `security-hardening` process
- Capabilities
- Input Schema
- Audit Checks
- Related Skills
What does the sandbox-entitlements-auditor skill do?
Audit and recommend minimal sandbox entitlements for secure desktop applications
How do I install it?
Run `npx skills add a5c-ai/babysitter --skill sandbox-entitlements-auditor --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From a5c-ai/babysitter, a repository with 1,642 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.