when-configuring-sandbox-security-use-sandbox-configurator

What this skill does

# Sandbox Security Configuration SOP

```yaml
metadata:
  skill_name: when-configuring-sandbox-security-use-sandbox-configurator
  version: 1.0.0
  category: specialized-tools
  difficulty: intermediate
  estimated_duration: 20-40 minutes
  trigger_patterns:
    - "configure sandbox security"
    - "sandbox isolation"
    - "file system boundaries"
    - "sandbox permissions"
    - "secure sandbox"
  dependencies:
    - Claude Code sandbox environment
    - Admin/root access (if applicable)
  agents:
    - security-manager (security architect)
    - cicd-engineer (infrastructure specialist)
  success_criteria:
    - Security policies defined
    - File boundaries configured
    - Network isolation set
    - Policies tested and verified
    - Documentation complete
```

## Overview

Configure Claude Code sandbox security with file system and network isolation boundaries. Ensures safe code execution with proper access controls and resource limits.

## Prerequisites

**Required:**
- Claude Code environment
- Understanding of security requirements

**Optional:**
- Existing security policies
- Compliance requirements (SOC2, HIPAA, etc.)

**Verification:**
```bash
# Check Claude Code version
claude --version

# Verify sandbox availability
echo "Sandbox check"
```

## Agent Responsibilities

### security-manager (Security Architect)
**Role:** Design security policies, define boundaries, validate configurations

**Expertise:**
- Security architecture
- Access control systems
- Compliance requirements
- Threat modeling

**Output:** Security policies, boundary definitions, validation tests

### cicd-engineer (Infrastructure Specialist)
**Role:** Implement security configurations, manage resources, deploy policies

**Expertise:**
- Infrastructure management
- System configuration
- Deployment automation
- Monitoring setup

**Output:** Configuration files, deployment scripts, monitoring tools

## Phase 1: Assess Security Requirements

**Objective:** Identify security needs, compliance requirements, and threat models

**Evidence-Based Validation:**
- Requirements documented
- Threat model created
- Compliance needs identified
- Risk assessment complete

**security-manager Actions:**
```bash
# Pre-task coordination
npx claude-flow@alpha hooks pre-task --description "Assess sandbox security requirements"

# Create security directory structure
mkdir -p sandbox-security/{policies,config,tests,docs}

# Document security requirements
cat > sandbox-security/docs/REQUIREMENTS.md << 'EOF'
# Sandbox Security Requirements

## Objectives
- Prevent unauthorized file access
- Isolate network communications
- Enforce resource limits
- Audit all operations
- Comply with security standards

## Threat Model

### Threats
1. **File System Escape**: Unauthorized access to host files
2. **Network Intrusion**: Malicious network connections
3. **Resource Exhaustion**: DoS through resource abuse
4. **Data Exfiltration**: Unauthorized data transfer
5. **Privilege Escalation**: Gaining unauthorized permissions

### Mitigations
1. File system boundaries and whitelisting
2. Network isolation and domain restrictions
3. CPU/memory/disk quotas
4. Audit logging and monitoring
5. Least privilege principles

## Compliance Requirements
- SOC 2 Type II (if applicable)
- GDPR data protection
- Internal security policies
- Industry standards (OWASP, NIST)

## Access Control
- Read-only for system files
- Read-write for workspace only
- No access to sensitive directories (/etc, /root, /sys)
- Temp directory with size limits
EOF

# Post-edit hook
npx claude-flow@alpha hooks post-edit --file "sandbox-security/docs/REQUIREMENTS.md" --memory-key "sandbox/requirements"

# Create threat assessment
cat > sandbox-security/docs/THREAT-ASSESSMENT.md << 'EOF'
# Threat Assessment

## Risk Matrix

| Threat | Likelihood | Impact | Risk Level | Mitigation Priority |
|--------|-----------|--------|------------|-------------------|
| File Escape | Medium | Critical | High | P0 |
| Network Intrusion | Low | High | Medium | P1 |
| Resource Exhaustion | High | Medium | Medium | P1 |
| Data Exfiltration | Low | Critical | High | P0 |
| Privilege Escalation | Low | Critical | High | P0 |

## Recommended Controls

### Critical (P0)
1. File system boundaries with strict whitelisting
2. Network isolation with trusted domain list
3. Mandatory audit logging

### High (P1)
4. Resource quotas and limits
5. Real-time monitoring and alerts
6. Regular security audits

### Medium (P2)
7. Automated security testing
8. Incident response procedures
9. Security awareness training
EOF

# Post-edit hook
npx claude-flow@alpha hooks post-edit --file "sandbox-security/docs/THREAT-ASSESSMENT.md" --memory-key "sandbox/threat-assessment"

# Store requirements in memory
npx claude-flow@alpha memory store \
  --key "sandbox/phase1-complete" \
  --value "{\"status\": \"complete\", \"threats_identified\": 5, \"controls_defined\": 9, \"timestamp\": \"$(date -Iseconds)\"}"
```

**Success Criteria:**
- [ ] Requirements documented
- [ ] Threat model created
- [ ] Risk matrix defined
- [ ] Controls prioritized

## Phase 2: Configure File Isolation

**Objective:** Set file system boundaries, define access rules, implement restrictions

**Evidence-Based Validation:**
- Boundaries configured
- Whitelist/blacklist defined
- Access rules tested
- Unauthorized access blocked

**security-manager Actions:**
```bash
# Define file system policy
cat > sandbox-security/policies/file-system-policy.json << 'EOF'
{
  "file_system": {
    "mode": "whitelist",
    "workspace": {
      "path": "/workspace",
      "permissions": "read-write",
      "size_limit_gb": 10
    },
    "allowed_paths": [
      "/workspace/**",
      "/tmp/sandbox/**",
      "/usr/local/bin",
      "/usr/bin",
      "/bin"
    ],
    "denied_paths": [
      "/etc/**",
      "/root/**",
      "/sys/**",
      "/proc/**",
      "/dev/**",
      "/home/**",
      "~/.ssh/**",
      "~/.aws/**",
      "~/.config/**"
    ],
    "temp_directory": {
      "path": "/tmp/sandbox",
      "size_limit_mb": 1000,
      "auto_cleanup": true,
      "cleanup_age_hours": 24
    },
    "readonly_paths": [
      "/usr/local/lib",
      "/usr/lib",
      "/lib"
    ]
  },
  "enforcement": {
    "strict_mode": true,
    "symlink_resolution": "deny",
    "case_sensitive": true,
    "audit_all_access": true
  }
}
EOF

# Post-edit hook
npx claude-flow@alpha hooks post-edit --file "sandbox-security/policies/file-system-policy.json" --memory-key "sandbox/file-policy"
```

**cicd-engineer Actions:**
```bash
# Create file isolation configuration script
cat > sandbox-security/config/configure-file-isolation.sh << 'EOF'
#!/bin/bash
set -e

echo "Configuring file system isolation..."

# Create workspace directory
mkdir -p /workspace
chmod 755 /workspace

# Create isolated temp directory
mkdir -p /tmp/sandbox
chmod 1777 /tmp/sandbox

# Set resource limits
cat > /etc/security/limits.d/sandbox.conf << 'LIMITS'
sandbox soft fsize 10485760
sandbox hard fsize 10485760
sandbox soft nofile 1024
sandbox hard nofile 2048
LIMITS

# Configure AppArmor profile (if available)
if command -v apparmor_parser &> /dev/null; then
  cat > /etc/apparmor.d/sandbox << 'APPARMOR'
#include <tunables/global>

profile sandbox {
  #include <abstractions/base>

  /workspace/** rw,
  /tmp/sandbox/** rw,
  /usr/bin/** rix,
  /bin/** rix,

  deny /etc/** rwklx,
  deny /root/** rwklx,
  deny /sys/** rwklx,
  deny /proc/sys/** rwklx,
  deny /home/** rwklx,
}
APPARMOR

  apparmor_parser -r /etc/apparmor.d/sandbox
  echo "AppArmor profile loaded"
fi

echo "File isolation configured successfully"
EOF

chmod +x sandbox-security/config/configure-file-isolation.sh

# Post-edit hook
npx claude-flow@alpha hooks post-edit --file "sandbox-security/config/configure-file-isolation.sh" --memory-key "sandbox/file-config"

# Store configuration
npx claude-flow@alpha memory store \
  --key "sandbox/phase2-complete" \
  --value "{\"status\": \"complete\", \"file_boundaries\":