Sandbox Claude Inside | Agent Skills Atlas

About this skill

Run Claude Code INSIDE a ca-sandbox box (--with-claude). Routed to when the user wants an agent loop running against an isolated, ephemeral sandbox rather than the host. Authenticates via an env-injected CLAUDECODEOAUTHTOKEN with no host bind of ~/.claude; the image pins the CLI and disables the autoupdater; HOME is backed by a named volume so the .claude state persists across restart. Five gated phases — posture, image, token, run, teardown. The hard default is offline or Anthropic-domains-only egress, and the token volume is NEVER co-mounted with an untrusted-code run; both are enforced, not advised.

Quick start

Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.

Installation guide →

Review, license & listing details

Review the source before using this skill

This is an imported listing. We haven’t certified its safety, license, or compatibility. Skills may include executable scripts.

Automated security scan: Partial

Only SKILL.md was scanned. Supporting files and scripts were not checked. No safety grade has been assigned.

0 potential findings · Scanned 11/4/2026 · Scanner 0.2.1

Content SHA-256: 40f5b0c24192f59cb09b6da6ab119096d9ae6abb27a94f29a6dbb592defc3748

About scan coverage and limitations

Original listing metadata

Original name

sandbox-claude-inside

Original description

Run Claude Code INSIDE a ca-sandbox box (`--with-claude`). Routed to when the user wants an agent loop running against an isolated, ephemeral sandbox rather than the host. Authenticates via an env-injected CLAUDE_CODE_OAUTH_TOKEN with no host bind of ~/.claude; the image pins the CLI and disables the autoupdater; HOME is backed by a named volume so the .claude state persists across restart. Five gated phases — posture, image, token, run, teardown. The hard default is offline or Anthropic-domains-only egress, and the token volume is NEVER co-mounted with an untrusted-code run; both are enforced, not advised.

About this listing

Category: General
Reported license: AGPL-3.0
Listing language (estimated): English
Review status: Not individually reviewed
Agent compatibility: Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.