# rivet-secure-exec

A skill that documents Secure Exec, a library for running Node.js code without a sandbox while keeping file, network and resource access under control.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 918 installs · ★ 43
- Author: rivet-dev
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/rivet-dev/skills/tree/HEAD/rivet-secure-exec/SKILL.md
- Updated: 2026-10-25
- HTML: https://affpapa.org/en/nevibecode/skills/rivet-secure-exec

## What it does

The skill covers Secure Exec from rivet-dev. It runs Node.js code without a container or VM, but with permissions for the filesystem and network, resource limits, separate contexts and output capture. Useful when your agent has to execute code you do not fully trust.

The reference walks through contexts, execute and evaluate, filesystem and mounts, host functions, lifecycle, long-running processes, networking, npm packages, permissions and resource limits. There are pages for concrete use cases too: an agent code tool, code mode, dev servers and plugin systems. Comparisons with Cloudflare Workers, container sandboxes, isolated-vm, QuickJS, secure-eval-worker and Vercel Run show where this approach sits next to the sandboxes you may already use.

The skill runs nothing on its own. It is documentation your agent reads before writing Secure Exec code. Check that your Node.js version fits the library, and set filesystem and network permissions explicitly instead of assuming they are granted.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add rivet-dev/skills --skill rivet-secure-exec -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/rivet-secure-exec/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/rivet-secure-exec/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add rivet-dev/skills --skill rivet-secure-exec -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/rivet-secure-exec/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add rivet-dev/skills --skill rivet-secure-exec -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/rivet-secure-exec/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install rivet-dev/skills rivet-secure-exec
```

2. **Manually: put the files in place**
- File: `.github/skills/rivet-secure-exec/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add rivet-dev/skills --skill rivet-secure-exec -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/rivet-dev/skills --path rivet-secure-exec
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/rivet-secure-exec/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add rivet-dev/skills --skill rivet-secure-exec -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/rivet-dev/skills/tree/HEAD/rivet-secure-exec/SKILL.md

## When to use it
- run agent-generated Node.js code without handing it the whole machine
- restrict a script's file reads and network calls
- set memory and time limits for untrusted code
- spin up isolated contexts for several jobs in one process
- embed code execution into a plugin system or dev server

## Example prompts
- show me how to run this script through Secure Exec with access only to `./data`
- I need network and memory limits for user-submitted code — write a Secure Exec example
- compare Secure Exec and a container sandbox for running code inside my agent

## Similar
- [deno-sandbox](https://affpapa.org/en/nevibecode/skills/deno-sandbox.md) — skill · 358 installs
- [zeroboot-vm-sandbox](https://affpapa.org/en/nevibecode/skills/zeroboot-vm-sandbox.md) — skill · 1300 installs
- [rivet-sdk](https://affpapa.org/en/nevibecode/skills/anthropics-rivet-sdk.md) — skill · 2100 installs
- [secure-workflow-guide](https://affpapa.org/en/nevibecode/skills/secure-workflow-guide.md) — skill · 7400 installs
- [netsuite-owasp-secure-coding](https://affpapa.org/en/nevibecode/skills/netsuite-owasp-secure-coding.md) — skill · 771 installs
- [develop-secure-contracts](https://affpapa.org/en/nevibecode/skills/develop-secure-contracts.md) — skill · 545 installs

From the same set: [rivet-dev/skills](https://affpapa.org/en/nevibecode/by/rivet-dev/skills.md) — 2 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md