Codex

Codex Skill Guide

When to Use Codex

• Tricky Debugging: Exceptional at finding elusive bugs that are hard to track down (mystery bugs, race conditions, edge cases)
• Security Analysis: Industry-leading vulnerability discovery - found zero-day CVEs in production frameworks, autonomous patch generation
• Code Review: Comprehensive security-focused code reviews, identifying vulnerabilities and anti-patterns
• Complex Refactoring: Large-scale code transformations with deep understanding of codebase context
• Agentic Coding: Multi-step autonomous software engineering tasks

Defaults

• Model: use the Codex CLI default (currently gpt-5.3-codex; the CLI picks this automatically, so omit -m unless overriding).
• Reasoning effort: medium unless the user selects otherwise.
• Sandbox mode: read-only unless edits or network access are needed.
• stderr: suppress with 2>/dev/null to drop thinking tokens. Show stderr only when the user asks for thinking output or when debugging an error.

Running a Task

1. Ask the user (via AskUserQuestion) which reasoning effort to use (xhigh, high, medium, or low). Default to medium if the user does not specify.
2. Select the sandbox mode required for the task; default to --sandbox read-only unless edits or network access are necessary.
3. Assemble the command with the appropriate options:

• -m, --model (omit to use the CLI default)
• --config model_reasoning_effort=""
• --sandbox
• --full-auto
• -C, --cd
• --skip-git-repo-check (include after confirming with user on first use per session)

1. To continue a previous session, pipe the new prompt via stdin: echo "your prompt here" | codex exec [flags] resume --last 2>/dev/null. Flags go between exec and resume. Resume inherits the model, reasoning effort, and sandbox mode from the original session. Pass flags only to override one of those values.
2. Append 2>/dev/null to every codex exec command to suppress thinking tokens (stderr). Show stderr only if the user asks to see thinking tokens or if you need to debug a failure.
3. Run the command, capture stdout/stderr (filtered as appropriate), and summarise the outcome for the user.
4. After Codex edits files, verify changes before proceeding:

• Run git diff to review modifications
• Run tests if applicable (npm test, pytest, etc.)
• Only commit or continue after validation passes

1. After Codex completes, tell the user: "You can resume this Codex session at any time by saying 'codex resume' or asking me to continue with additional analysis or changes."

Task Checklist

- [ ] 1. Select reasoning effort (default: medium)
- [ ] 2. Select sandbox mode (default: read-only)
- [ ] 3. Assemble command with flags (model defaults to CLI's current default)
- [ ] 4. Get permission for high-impact flags (if --full-auto or danger-full-access)
- [ ] 5. Run command with 2>/dev/null
- [ ] 6. Summarise outcome
- [ ] 7. Verify changes (git diff, tests) if edits made
- [ ] 8. Inform user about resume option

Following Up

• After every codex command, use AskUserQuestion to confirm next steps, collect clarifications, or decide whether to resume with codex exec resume --last.
• Restate the chosen reasoning effort and sandbox mode when proposing follow-up actions.

Error Handling

• Stop and report failures whenever codex --version or a codex exec command exits non-zero; request direction before retrying.
• Before using high-impact flags (--full-auto, --sandbox danger-full-access, --skip-git-repo-check), ask the user for permission using AskUserQuestion unless permission was already granted.
• When output includes warnings or partial results, summarise them and ask how to adjust using AskUserQuestion.

Quick Reference

Append 2>/dev/null to every command below to suppress thinking tokens.

| Use case | Sandbox mode | Key flags | | --- | --- | --- | | Read-only review or analysis | read-only | --sandbox read-only | | Apply local edits | workspace-write | --sandbox workspace-write --full-auto | | Permit network or broad access | danger-full-access | --sandbox danger-full-access --full-auto | | Resume recent session | Inherited from original | echo "prompt" \| codex exec resume --last (add flags between exec and resume only to override inherited values) | | Run from another directory | Match task needs | -C plus other flags |

Examples

User: "Review this file for security vulnerabilities"

Claude assembles:

codex exec --skip-git-repo-check --config model_reasoning_effort="high" --sandbox read-only 2>/dev/null

After completion: "Analysis complete. Found 2 potential SQL injection vulnerabilities in db/queries.ts. You can resume this Codex session at any time by saying 'codex resume' or asking me to continue with additional analysis."

User: "Fix the race condition bug in the worker pool"

Claude assembles:

codex exec --skip-git-repo-check --config model_reasoning_effort="high" --sandbox workspace-write --full-auto 2>/dev/null

After edits: Runs git diff to show changes, runs npm test to verify fix, then: "Fixed the race condition by adding mutex locks. Tests pass. You can resume this session with 'codex resume'."

User: "Continue analysing that code" (after previous session)

Claude assembles:

echo "Continue the security analysis, focusing on authentication flows" | codex exec --skip-git-repo-check resume --last 2>/dev/null

Note: No model/sandbox flags needed -- inherited from original session.

Reasoning Effort Levels

Codex CLI context window: 400K input / 128K output. Check Codex releases for current pricing and benchmarks.

| Reasoning | Best for | | --- | --- | | xhigh | Zero-day vulnerability discovery, deep architecture analysis, multi-hour agentic tasks | | high | Security analysis, complex refactoring, performance optimisation, debugging race conditions | | medium (default) | Feature additions, bug fixes, code review, standard refactoring | | low | Quick fixes, formatting, documentation, simple changes |

Cached input tokens receive a significant discount. Repeated context within 24 hours benefits from this automatically.

CLI Version

Requires a recent Codex CLI version. Check with codex --version. See Codex releases for the latest version and current default model.

Use the /model slash command within a Codex session to switch models, or configure the default in ~/.codex/config.toml.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: costa-marcello
• Source: costa-marcello/skillkit
• License: MIT

Install and usage instructions live in the source repository linked above.