Codex: Codex CLI Skills, Sandbox & Examples
Last updated: 2026-08-31
CLI is Codex's most flexible usage mode. This lesson covers Skills, sandbox configuration, and practical examples in the CLI environment.
📋 Prerequisites: Understanding Codex CLI basic operations
1. What You Will Learn
- CLI Skills management
- Sandbox security in detail
- Practical example collection
- CLI prompt techniques
2. CLI Skills Management
(1) List Available Skills
BASH
codex --list-skills
(2) Use a Skill
BASH
# Specify Skill to execute task
codex --skill code-review "Review src/auth.ts"
# Combine options
codex --skill security --sandbox readonly "Scan for security vulnerabilities"
(3) Custom Skill Location
BASH
# Specify Skills directory
codex --skills-dir ./my-skills "Add login functionality"
(4) Skill File Format
MARKDOWN
<!-- .codex/skills/api-endpoint.md -->
# API Endpoint Generator
## Role
FastAPI endpoint development expert
## Rules
- Use Pydantic models
- Include error handling
- Add Swagger documentation
- Write pytest tests
## Workflow
1. Define request/response models
2. Implement endpoint logic
3. Add error handling
4. Write tests
5. Ensure pytest passes
3. Sandbox Security In Detail
(1) Sandbox Implementation Methods
| Method | Description | Security Level |
|---|---|---|
| Docker | Container isolation | Highest |
| chroot | Directory isolation | Medium |
| Process-level | Permission restrictions | Basic |
(2) Docker Sandbox Configuration
TOML
[sandbox]
type = "docker"
image = "codex-sandbox:latest"
memory = "2g"
cpus = 2
timeout = 600
# Mount volumes
volumes = [
"./src:/workspace/src",
"./tests:/workspace/tests",
]
# Environment variables
env = { "NODE_ENV" = "test" }
(3) Sandbox Permission Matrix
| Operation | readonly | workspace-write | full-access |
|---|---|---|---|
| Read files | ✅ | ✅ | ✅ |
| Write workspace | ❌ | ✅ | ✅ |
| Write system | ❌ | ❌ | ✅ |
| Execute commands | ❌ | ⚠️ Confirm | ✅ |
| Network access | ❌ | ❌ | ✅ |
▶ Example 1: Alice's Security Configuration
TOML
# Alice's sandbox config
[sandbox]
type = "docker"
memory = "4g"
cpus = 4
# Allowed operations
allowed_commands = [
"npm test",
"npm run lint",
"git status",
"git diff",
"tsc --noEmit",
]
# Blocked operations
blocked_commands = [
"rm -rf /",
"sudo",
"curl * | sh",
]
# Resource limits
max_file_size = "10MB"
max_execution_time = 300
4. Practical Example Collection
(1) Project Initialization
BASH
codex "Initialize Next.js 14 project: TypeScript + Tailwind + ESLint + Prettier, create standard directory structure"
(2) Bug Fixing
BASH
# Fix from error log
cat error.log | codex --full-auto "Analyze error log, locate root cause, fix code"
# Fix from Issue
codex "Fix Issue #42: Users not receiving verification email after registration"
(3) Test Generation
BASH
# Generate tests for all source files
codex --full-auto "Generate corresponding .test.ts for all .ts files under src/, using vitest"
# Supplement test coverage
codex "Check test coverage, supplement tests for files below 80%"
(4) Code Refactoring
BASH
# Framework migration
codex "Refactor all Class components to functional components + Hooks"
# API migration
codex "Migrate REST API calls to tRPC, maintain functionality"
(5) Documentation Generation
BASH
# API documentation
codex "Generate OpenAPI/Swagger docs for all API endpoints"
# README
codex "Generate README.md based on project structure and code"
▶ Example 2: Bob's Day
BASH
# Morning: pull code + fix lint
git pull
codex --full-auto "Fix all lint errors"
# Forenoon: new feature
codex "Add user avatar upload with crop and compression"
# Afternoon: bug fix
codex "Fix payment timeout issue, add retry mechanism"
# Evening: tests
codex "Supplement integration tests for today's changes"
# Night: documentation
codex "Update API docs and CHANGELOG"
5. CLI Prompt Techniques
(1) Precise File References
BASH
# Good practice
codex "Modify src/auth/login.ts, add 2FA support"
# Bad practice
codex "Add a feature to login"
(2) Include Verification
BASH
codex "Optimize database query performance, ensure npm test passes, compare execution time before and after optimization"
(3) Step-by-step Execution
BASH
# Complex task in steps
codex "Step 1: Create the Order model. Output the model definition when done, I'll confirm before continuing to step 2."
(4) Reference Existing Code
BASH
codex "Create UserProfile component, follow the style of src/components/UserCard.tsx"
❓ FAQ
Q Are CLI Skills the same as App Skills?
A Same format, but CLI requires specifying via
--skill parameter, while App lets you select through the UI.Q Does the sandbox affect performance?
A Docker sandbox has some startup overhead (~2-5 seconds), but runtime performance difference is minimal. Process-level sandbox has virtually no overhead.
Q Can CLI run multiple tasks simultaneously?
A Open multiple terminal windows, each running a Codex instance. Use Worktrees to avoid file conflicts.
Q How do I view detailed CLI execution logs?
A Use
--verbose parameter or --log-file to specify a log file.Q Can CLI non-interactive mode handle confirmation requests?
A Requires
--approval-policy approve or --full-auto. Otherwise non-interactive mode will hang waiting for confirmation.📖 Summary
- CLI Skills:
--skillto specify,--list-skillsto view - Sandbox: Docker is most secure, process-level is lightest
- Practical examples: Initialize / Bug fix / Tests / Refactor / Documentation
- Prompts: precise references + include verification + step-by-step execution
📝 Exercises
- Basic (⭐): Use CLI Skills to complete a code review.
- Intermediate (⭐⭐): Configure a Docker sandbox, execute a task within it.
- Advanced (⭐⭐⭐): Write a CLI automation script covering all daily development Codex tasks.
