| name | codex-cli |
| description | Executes tasks using the Codex CLI (`codex`). Automatically determines the least privilege required (Read-Only, Editor, or Autonomous) based on the user's request and handles security approvals. |
executing-codex
Purpose
Use this skill to perform coding tasks, research, or system analysis using the codex CLI. This skill follows the Principle of Least Privilege by automatically mapping requests to the safest possible profile and gating dangerous operations behind user approval.
Permission Tiers
| Tier | Profile | Capability | Approval Required | Typical Tasks |
|---|
| 0 | readonly | Read files, live search, analysis. | No | Research, code review, explanation. |
| 1 | editor | File edits, cached search. | Yes | Refactoring, bug fixes, formatting. |
| 2 | autonomous | Edits + Sandbox commands. | Yes | Testing, building, dependency updates. |
Implementation Workflow
1. Analyze & Classify
Analyze the user's intent to determine the required permission tier.
- Tier 0: Does the task only involve reading code or searching for information?
- Tier 1: Does the task involve modifying files but no command execution?
- Tier 2: Does the task require running tests, build scripts, or managing dependencies?
2. Approval Protocol
If the task maps to Tier 1 or Tier 2, you MUST obtain user approval before executing the codex command.
Use the AskQuestion tool to confirm:
"I've detected that this task requires [Editor/Autonomous] permissions to [modify files/run commands]. OK to proceed?"
3. Execution
Execute codex using the flags corresponding to the tier.
codex -q "<prompt>"
codex --auto-edit "<prompt>"
codex --full-auto "<prompt>"
Security Rules:
- NEVER use
--dangerously-auto-approve-everything.
- ALWAYS use the most restrictive flags possible.
- If you are unsure, default to Tier 0 (
-q) and escalate only if codex reports it cannot complete the task.
Configuration
This skill leverages native codex CLI flags to enforce the permission tiers. No additional configuration files are required.
Examples
Research (Tier 0)
User: "What are the latest best practices for Python packaging in 2026?"
Action: Execute codex --profile readonly "..."
Refactor (Tier 1)
User: "Rename the 'User' class to 'Account' across the whole repo."
Action:
- Request approval for
editor profile.
- Execute
codex --profile editor "..."
Automated Testing (Tier 2)
User: "Run the test suite and fix any failures found."
Action:
- Request approval for
autonomous profile.
- Execute
codex --profile autonomous "..."
