Step 1 of 4
Audit the current tool prompt
You cannot layer what you have not inventoried.
Take one tool prompt from your agent (the shell/exec tool is the best candidate) and classify every line into three buckets: PREFERENCE (which tool or approach to choose - 'read files with the Read tool, not cat'), USAGE (mechanics - absolute paths, chaining commands, timeouts, output limits), and SAFETY (destructive operations, credentials, force-push class rules). Flag lines that are prohibitions without an alternative, lines that bury safety rules mid-list, and duplicated or contradictory rules. Count tokens per bucket so you know where the budget goes. Produce a table: line, bucket, problem, rewrite-needed yes/no.
Expected after this step
A classified inventory of the tool prompt with problems flagged.
Should not happen
- ✕One flat list where preferences, mechanics, and safety rules interleave randomly
- ✕Bare prohibitions ('do not use sed') with no alternative, leaving the model to guess
- ✕NEVER used for trivia, diluting its force for the operations that matter
- ✕Safety rules framed so heavily the model refuses routine safe work
Verify before continuing
Do not move on until every check is true. The complete button stays locked until then.
Do not continue if…
- !One flat list where preferences, mechanics, and safety rules interleave randomly
- !Bare prohibitions ('do not use sed') with no alternative, leaving the model to guess
- !NEVER used for trivia, diluting its force for the operations that matter
- !Safety rules framed so heavily the model refuses routine safe work
If the AI messes this up
Use this when the AI fakes progress or breaks the feature. It forces a real fix.
The audit says everything is 'usage'. Re-check: any line naming a competing tool or approach is a PREFERENCE, and any line about irreversible effects is SAFETY - if those buckets are empty, the prompt is missing them, which is itself the finding.