Allowlist npm registry in Cowork sandbox to enable built-in slide-deck-designer skill

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

aThe Cowork sandbox blocks all npm package installations via a proxy allowlist (registry.npmjs.org returns 403 Forbidden). This also blocks unpkg.com, jsdelivr.net, and cdnjs.cloudflare.com.

This prevents Anthropic's own built-in slide-deck-designer skill from functioning, because its "create from scratch" workflow depends on npm packages: pptxgenjs, react, react-dom, react-icons, and sharp. None of these can be installed.

The result is that a skill shipped by Anthropic cannot run in Anthropic's own sandbox environment. Any user-created skills or plugins that depend on npm packages are also blocked.

Proposed Solution

Option A (Preferred): Allowlist registry.npmjs.org in the Cowork sandbox proxy, enabling standard npm install to work.

Option B: Allowlist specific package tarballs required by built-in skills (pptxgenjs, react, react-dom, react-icons, sharp).

Option C (Fallback): Pre-install these critical npm packages in the Cowork sandbox Docker image so they are available without network access.

Alternative Solutions

Currently, we work around this by using python-pptx (which is pre-installed) instead of pptxgenjs for presentation creation. However, python-pptx produces lower-quality output compared to the skill's intended pptxgenjs workflow.

We also tried fetching packages via alternative CDNs (unpkg.com, jsdelivr.net, cdnjs.cloudflare.com) and direct curl/wget — all are blocked by the same proxy allowlist.

The pip package manager works for Python packages (pypi.org appears to be allowlisted), but npm has no equivalent access. Extending the same allowlist pattern to registry.npmjs.org would resolve this issue.

Priority

High - Significant impact on productivity

Feature Category

Configuration and settings

Use Case Example

1. User asks Cowork to "create a presentation about youth governance"
2. 2. Cowork activates the built-in slide-deck-designer skill
3. 3. Skill tries to run npm install -g pptxgenjs — fails with 403 Forbidden
4. 4. The entire "create from scratch" workflow is blocked
5. 5. With npm registry allowlisted, the skill would install pptxgenjs and generate a professional .pptx file as designed

Additional Context

Environment: Cowork mode (Claude Desktop, research preview)
Sandbox proxy: HTTP proxy at localhost:3128 with domain allowlist
Blocked domains: registry.npmjs.org, unpkg.com, jsdelivr.net, cdnjs.cloudflare.com, github.com
Working: pip/pypi.org (Python packages install normally)

This appears to be an oversight where the sandbox allowlist was configured for Python tooling but not for Node.js/npm tooling, even though built-in skills depend on npm packages.