# Configure Network Isolation for AI Coding

AI coding tools need controlled network access to reduce data leaks and malicious downloads. This skill helps define trusted domains, proxy settings, and safe environment variable rules.

## Install

```bash
npx skillstore add dnyoussef/network-security-setup
```

## Metadata

- Status: approved
- Slug: dnyoussef-network-security-setup
- Version: 1.0.0
- Author version: 1.0.0
- Skillstore revision: r1
- Version status: valid
- Tree hash: 7e38bd863ea8e07235f2061a1f725680dbc14e8c1731c38055abedaf2b2fb207
- Author: DNYoussef
- GitHub username: DNYoussef
- License: MIT
- Repository: https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/network-security-setup
- Ref: c579efd02184f1128d6741d16e6c8d951d7d4208
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, env\_access
- Quality score: 80
- Quality tier: silver
- Public page: https://skillstore.pages.dev/skills/dnyoussef-network-security-setup
- Manifest: https://skillstore.pages.dev/api/skills/dnyoussef-network-security-setup/manifest

## Capabilities

- Select trusted, custom, or no-network sandbox modes.
- Build trusted domain lists for registries, source control, CDNs, and internal services.
- Plan corporate proxy and no-proxy settings for enterprise environments.
- Separate safe configuration variables from secrets that belong outside sandbox settings.
- Define validation checks for allowed and blocked network access.
- Document threats mitigated by deny-by-default network rules.

## Use Cases

- Open Source Development: Allow package registries and GitHub while blocking unrelated outbound network access.
- Enterprise Sandbox Policy: Define internal registries, proxy settings, and trusted public services for controlled AI coding work.
- Sensitive Project Isolation: Choose no-network or strict custom access for projects with confidential code or regulated data.

## Prompt Templates

### Basic Trusted Access

```
Configure trusted network access for a JavaScript project. Allow npm, GitHub, and common CDNs. Keep secrets out of sandbox settings.
```

### No-Network Mode

```
Create a no-network sandbox policy for a sensitive repository. Include validation steps and explain what workflows may fail.
```

### Enterprise Custom Domains

```
Design a custom network policy. Include our internal registry, documentation site, corporate proxy, and only required public registries.
```

### Threat-Driven Review

```
Review this sandbox access plan against prompt injection, malware downloads, data exfiltration, and internal network scanning risks.
```

## Limitations

- It provides configuration guidance, not a runnable enforcement engine.
- It depends on the host tool supporting sandbox network controls.
- It cannot verify private domains without user-provided environment details.
- It does not replace formal enterprise security review.

## Best Practices

- Start with deny-by-default access, then add only required domains.
- Document secret names without storing secret values in sandbox configuration.
- Test both allowed package operations and blocked untrusted destinations.

## Anti Patterns

- Allowing broad wildcard domains without a clear business need.
- Putting API keys, database URLs, or private keys in sandbox settings.
- Skipping validation after changing proxy or trusted domain rules.

## Security Audit

- Audited at: 2026-07-05T13:51:07.238\+00:00
- Summary: The static alerts are false positives caused by Markdown examples, placeholder domains, and secret-handling guidance. I found no code that executes shell commands, reads environment files, accesses real credentials, or performs network reconnaissance; no prompt injection text was present.

## Stats

- Views: 283
- Downloads: 10
- Favorites: 0
- Popularity score: 0