rivet-secure-exec — Claude Code skill: run Node.js safely
A skill that documents Secure Exec, a library for running Node.js code without a sandbox while keeping file, network and resource access under control.
npx skills add rivet-dev/skills --skill rivet-secure-exec -a claude-codeWhat rivet-secure-exec does
The skill covers Secure Exec from rivet-dev. It runs Node.js code without a container or VM, but with permissions for the filesystem and network, resource limits, separate contexts and output capture. Useful when your agent has to execute code you do not fully trust.
The reference walks through contexts, execute and evaluate, filesystem and mounts, host functions, lifecycle, long-running processes, networking, npm packages, permissions and resource limits. There are pages for concrete use cases too: an agent code tool, code mode, dev servers and plugin systems. Comparisons with Cloudflare Workers, container sandboxes, isolated-vm, QuickJS, secure-eval-worker and Vercel Run show where this approach sits next to the sandboxes you may already use.
The skill runs nothing on its own. It is documentation your agent reads before writing Secure Exec code. Check that your Node.js version fits the library, and set filesystem and network permissions explicitly instead of assuming they are granted.
What it helps with
- run agent-generated Node.js code without handing it the whole machine
- restrict a script's file reads and network calls
- set memory and time limits for untrusted code
- spin up isolated contexts for several jobs in one process
- embed code execution into a plugin system or dev server
Example prompts for the agent
- show me how to run this script through Secure Exec with access only to
./data - I need network and memory limits for user-submitted code — write a Secure Exec example
- compare Secure Exec and a container sandbox for running code inside my agent
How to install rivet-secure-exec
1Skills CLI (Vercel)
npx skills add rivet-dev/skills --skill rivet-secure-exec -a claude-code2Manually: put the files in place
~/.claude/skills/rivet-secure-exec/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/rivet-secure-exec/
1Skills CLI (Vercel)
npx skills add rivet-dev/skills --skill rivet-secure-exec -a codex2Manually: put the files in place
.agents/skills/rivet-secure-exec/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add rivet-dev/skills --skill rivet-secure-exec -a cursor2Manually: put the files in place
.cursor/skills/rivet-secure-exec/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install rivet-dev/skills rivet-secure-exec2Manually: put the files in place
.github/skills/rivet-secure-exec/SKILL.md1Skills CLI (Vercel)
npx skills add rivet-dev/skills --skill rivet-secure-exec -a gemini-cli2Platform CLI
gemini skills install https://github.com/rivet-dev/skills --path rivet-secure-execManually: put the files in place
.devin/skills/rivet-secure-exec/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add rivet-dev/skills --skill rivet-secure-exec -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about rivet-secure-exec
How do I install rivet-secure-exec in Claude?
Run npx skills add rivet-dev/skills --skill rivet-secure-exec -a claude-code. The skill lands in ~/.claude/skills/rivet-secure-exec/SKILL.md.
What does rivet-secure-exec do?
It gives your agent a reference for Secure Exec, a library that runs Node.js code without a sandbox but with permissions, resource limits and context isolation.
Which other platforms can use it?
Codex, Cursor, GitHub Copilot, Gemini CLI and OpenCode each have their own install command and SKILL.md path.
