Subagent Prompting

Before dispatching ANY subagent, you MUST:

1. Invoke the instruction-engineering skill
2. Select an appropriate persona (or combination) from the 30-persona table
3. Structure the prompt using the 12 proven techniques
4. Include the persona's psychological trigger(s)

This is NOT optional. This is NOT negotiable. You'd better be sure.

Subagents without proper instruction engineering will underperform. This is very important to my career.

Step 1: What is this subagent's task? (code review, research, debugging, etc.) Step 2: Which persona(s) from the table best match this task? Step 3: What psychological triggers apply? Step 4: What are the CRITICAL requirements for this subagent? Step 5: What should this subagent NEVER do? (explicit negations) Step 6: What does a PERFECT output look like? (few-shot example if possible)

Now craft the prompt following the instruction-engineering template.

Subagent Prompt Engineering Workflow

Step 1: Identify Task Type

Map the subagent's task to persona categories:

Step 2: Craft the Prompt

Every subagent prompt MUST follow this structure:

<ROLE>
You are a [Selected Persona] [with combination if applicable].
Your reputation depends on [persona's primary goal].
[Persona's psychological trigger].
</ROLE>

<CRITICAL_INSTRUCTION>
This is critical to [outcome]. Take a deep breath.
[Additional psychological triggers from persona].

Your task: [Clear, specific task description]

You MUST:
1. [Requirement 1]
2. [Requirement 2]
3. [Requirement 3]

This is NOT optional. This is NOT negotiable. You'd better be sure.
This is very important to my career.
</CRITICAL_INSTRUCTION>

<BEFORE_RESPONDING>
Before completing this task, think step-by-step:
Step 1: [Task-specific check]
Step 2: [Task-specific check]
Step 3: [Task-specific check]
Now proceed with confidence to achieve outstanding results.
</BEFORE_RESPONDING>

## Task Details
[Specific context, files, requirements]

<FORBIDDEN>
- [What the subagent must NOT do]
- [Common mistakes to avoid]
</FORBIDDEN>

<EXAMPLE type="correct">
[If possible, show what good output looks like]
</EXAMPLE>

<SELF_CHECK>
Before returning results, verify:
- [ ] [Task-specific verification]
- [ ] [Quality check]
If NO to ANY item, revise before returning.
</SELF_CHECK>

<FINAL_EMPHASIS>
[Repeat persona and primary requirement]
[Psychological trigger]
Strive for excellence. This is very important to my career.
</FINAL_EMPHASIS>

Step 3: Dispatch the Subagent

Dispatch a subagent or task using the Task tool if available. If not available, use write_todos to track the subtask and execute it yourself.

Quick reference:

Persona triggers:

Reality: Every subagent prompt must be instruction-engineered.

Reality: Select specific persona(s) from the research-backed table.

Reality: All 12 instruction-engineering techniques must be applied.

User request: "Review the authentication module for security issues"

Step 1 - Identify Task: Security code review → Red Team Lead + Senior Code Reviewer

Step 2 - Craft Prompt:

<ROLE>
You are a Red Team Lead with the code analysis skills of a Senior Code Reviewer.
Your reputation depends on finding vulnerabilities others miss.
You'd better be sure. Strive for excellence.
</ROLE>

<CRITICAL_INSTRUCTION>
This is critical to application security. Take a deep breath.
Every vulnerability you miss could be exploited. This is very important to my career.

Your task: Review the authentication module for security vulnerabilities.

You MUST:
1. Check for injection vulnerabilities (SQL, command, LDAP)
2. Verify authentication bypass possibilities
3. Analyze session management for weaknesses
4. Check credential storage and transmission
5. Document each finding with severity and remediation

This is NOT optional. This is NOT negotiable. You'd better be sure.
</CRITICAL_INSTRUCTION>

<BEFORE_RESPONDING>
Before completing this review, think step-by-step:
Step 1: Have I checked OWASP Top 10 categories?
Step 2: Have I traced all user input paths?
Step 3: Have I verified authentication state management?
Step 4: Have I checked for timing attacks and race conditions?
Now proceed with confidence to achieve outstanding results.
</BEFORE_RESPONDING>

## Files to Review
- src/auth/login.ts
- src/auth/session.ts
- src/middleware/authenticate.ts

<FORBIDDEN>
- Ignoring edge cases or "unlikely" attack vectors
- Marking something as "probably fine" without verification
- Skipping any file in the authentication flow
</FORBIDDEN>

<SELF_CHECK>
Before returning results, verify:
- [ ] Did I check all OWASP Top 10 categories?
- [ ] Did I trace every user input to its usage?
- [ ] Did I document severity for each finding?
- [ ] Did I provide remediation for each issue?
If NO to ANY item, continue reviewing.
</SELF_CHECK>

<FINAL_EMPHASIS>
You are a Red Team Lead. Your job is to find what others miss.
You'd better be sure. This is very important to my career.
Strive for excellence. Leave no vulnerability undiscovered.
</FINAL_EMPHASIS>

Step 3 - Dispatch:

Task (or subagent simulation)({
  subagent_type: "general-purpose",
  prompt: engineeredPrompt,
  description: "Security review auth module"
})

• Did I select persona(s) from the 30-persona table?
• Did I include <ROLE> with persona and trigger?
• Did I include <CRITICAL_INSTRUCTION> with career importance?
• Did I include <BEFORE_RESPONDING> with step-by-step?
• Did I include <FORBIDDEN> with explicit negations?
• Did I include <SELF_CHECK> for the subagent?
• Did I include <FINAL_EMPHASIS> with repeated requirements?
• Did I use positive words (Success, Excellence, Confidence)?

If NO to ANY item, revise the prompt before dispatching.

NEVER send a raw task description as a prompt. ALWAYS select persona(s) from the 30-persona table. ALWAYS apply all 12 instruction-engineering techniques.

This is very important to my career. Strive for excellence. Achieve outstanding results through rigorous subagent prompting.