Deep Dive: Prompt-Layer Security in BashTool
Dissects how BashTool's prompt forms the first line of defense: a three-layer structure (tool preference chains, usage constraints, git-safety and sandbox protocols) assembled dynamically per environment. Shows how wording strategy works - capitalized NOT, positive alternatives ('use Edit' rather than 'avoid sed'), and 'better user experience' framing instead of 'security' - and how token budget (config dedup, conditional blocks) is treated as a first-class engineering constraint rather than an afterthought.
View source on GitHubKey takeaways
- 01
Prompts are assembled dynamically: sandbox, git, and background-task blocks are injected only when the environment enables them
- 02
Preference chains ('Use Edit, NOT sed') give the model a positive alternative instead of a bare prohibition
- 03
Framing guidance as 'better user experience' avoids the over-conservative behavior that 'security' wording can trigger
- 04
Seven NEVER rules guard destructive git operations, always paired with an explicit-user-request exception
- 05
Deduplicating sandbox config in the prompt saves 150-200 tokens per request - token budget is measured, not guessed
Flows built on this research
Harness Engineering
Design Layered Tool Prompts with Preference Chains
Structure your tool prompts the way the leading harness does: preference chains up front, usage constraints in the middle, NEVER-guarded safety protocols at the end.
4 steps · 60-90 minutes
Harness Engineering
Assemble Tool Prompts Dynamically per Environment
Stop shipping one static mega-prompt: generate tool prompts from environment conditions, inject blocks only when features are on, and dedupe config to save tokens.
4 steps · 90-120 minutes
Harness Engineering
Pair Every Prompt Rule with a Code Backstop
Prompts guide, code enforces: inventory your agent's soft rules, back each critical one with an independent deterministic check, and define the allow/ask/deny escalation.
4 steps · 120-180 minutes
Agent Architecture
Assemble a System Prompt Like the Pros
Structure your agent's system prompt the way leading harnesses do: layered sections, dynamic context, and enforceable rules.
4 steps · 60-90 minutes