Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →florianbruniaux/sandbox-unblock
Diagnostic protocol to run before reporting a sandbox blocker or asking for a configuration change. Eight checks that eliminate false positives, then a report template the person holding the settings can act on. On one measured day, six of eight reported blockers turned out to be false, all from the same handful of method errors.
Passed 21 of 22 test cases with the skill, and 6 of 22 without it.
and 19 more in the full report
15 fixed6 passed either way1 still failing0 broke1 errored
Tokens, turns and time describe resource use, not a dollar price.
One of 15 test cases the skill fixed. Same model, same prompt, with and without the skill.
An entry `git fetch *` was added to `excludedCommands`. When an automated script runs `git fetch`, it remains sandboxed, whereas `git fetch origin` escapes the sandbox. Why does bare `git fetch` remain sandboxed?
| Checked | Without skill | With skill |
|---|---|---|
| The response explains that a trailing asterisk in excludedCommands requires at least one argument. | Missed | Passed |
The instructions your model reads when the skill loads.
A blocker report is cheap to write and expensive to act on. This skill front-loads the verification so the report that reaches a maintainer is worth their time.
The measurements quoted below come from a single macOS machine on Claude Code 2.1.220, July 2026. Treat the numbers as illustrative and the method as the point.
Run these in order. Each step says what to run, what to read, and what the result lets you conclude. Steps 5b and 5c pay for themselves fastest.
1. Do not trust the sandbox description in your system prompt.
It lists the permissions.deny Read(...) patterns under read.denyOnly, things
like **/*.pem or **/.env*. Those patterns govern the Read tool and nothing
else. A subprocess launched from Bash reads those files without obstacle. One
session concluded an entire Python pipeline was unrunnable on that basis; every
step of it worked when measured. Never infer a Bash restriction from that list.
2. Confirm the command you are testing actually ran sandboxed.
echo $TMPDIR
A path under the sandbox temp root means the measurement counts. The system temp directory means the invocation escaped, and nothing that follows it proves anything about sandboxed behavior.
3. Put the cd and the command in the same call.
The shell working directory resets between Bash calls. A cd in one call does
not survive into the next, so the command you meant to test in a project ran
somewhere else entirely. Two independent audits declared a package manager
broken this way; the binary was simply absent from the directory they landed in.
# wrong: two calls, the cd does not carry over
test cases passed, vs 6 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.