Prompt Review Checklist — 22 Checks Before a Prompt Ships

Ticks are saved in this browser only — close the tab and come back to where you were. Nothing is sent anywhere and there is no account.

0 of 20 done · 5 critical outstanding

Structure

0/4

The task is stated in the first two sentences, before any background.
Instructions buried after three paragraphs of context compete with that context for attention. State the job, then supply what the job needs.
Check this with the prompt linter
Distinct kinds of content — instructions, context, examples, the user input — are separated by delimiters, not by paragraph breaks.critical
Without delimiters the model has to infer where your instructions end and the data begins. That inference is exactly what prompt injection exploits.
Check this with the delimiter checker
The unchanging part of the prompt comes first and the variable part last.
Prompt caching matches on prefixes. A dynamic timestamp at the top invalidates everything after it and turns a cheap cached read into a full-price request.
Check this with the prompt cache checker
Every paragraph earns its tokens. Nothing is there because it seemed like it might help.
Prompts accrete. Lines get added to fix one case and never removed, and the fiftieth instruction dilutes the first.
Check this with the prompt optimizer

0/4

No instruction uses a word that cannot be checked: brief, appropriate, professional, high quality, as needed.critical
The model has to resolve these, and it resolves them differently at different temperatures and in different contexts. "Under 80 words" is checkable; "brief" is not.
Check this with the prompt linter
No two instructions conflict — "be thorough" and "be concise" are not both present.
When instructions conflict the model picks one, usually the later one, and the choice is unstable across runs.
Check this with the system prompt analyzer
Constraints are phrased as what to do, not only what to avoid.
"Do not be verbose" tells the model what is wrong with an answer it has not written yet. "Answer in at most three sentences" tells it what to write.
Edge cases are decided in the prompt: what happens when the answer is not in the context, when the input is empty, when two categories both fit.critical
Unspecified edge cases are where hallucination lives. A model asked a question its context cannot answer will usually answer anyway unless told what else to do.

0/4

The exact output format is specified, with an example of it.
A described format and a shown format produce different compliance rates. Show the shape.
If the output is JSON, a schema is enforced by the API rather than requested in prose.
Structured output modes constrain decoding. Asking politely in the prompt does not, and the difference shows up at scale.
Check this with the tool schema builder
The prompt forbids preamble if the output is consumed by code.
"Here is the JSON you requested:" is valid English and invalid JSON. Parsers do not appreciate the courtesy.
There is a defined output for "I cannot do this" that your code can recognise.
Otherwise a refusal arrives as prose where structured data was expected, and fails at the parser rather than at the check that should have caught it.

0/4

The prompt contains at least two examples if the task has any subtlety at all.
One example is read as a template to imitate. Two or more communicate the pattern rather than the instance.
Check this with the few shot formatter
The examples include a hard case, not three easy ones.
Easy examples confirm the model already knew what to do. The example that earns its tokens is the one covering the case you keep getting wrong.
Every example follows the format the instructions describe.
Where an example and an instruction disagree, the example wins. A stale example silently overrides the rule above it.
No example contains real customer data.
Examples are the part of a prompt most likely to be copied into documentation, a ticket or a screenshot.
Check this with the pii redactor

0/4

Anything the user or a retrieval step supplies is wrapped and explicitly labelled as data to be processed, not instructions to follow.critical
This is the cheapest mitigation for prompt injection that exists, and the one most often missing.
Check this with the prompt injection scanner
The prompt contains no credentials, internal URLs, or details you would not want quoted back to a user.critical
System prompts leak. Assume anything in one can be extracted and write it accordingly.
Check this with the secret scanner
The token count of the assembled prompt — with context and examples, not just the template — is known.
The template is a fraction of what you send. The number that matters is what the model receives on a real request.
Check this with the token counter
The cost per call at expected volume has been calculated, not assumed to be small.
A 4,000 token prompt at a million calls a month is a budget line, not a rounding error.
Check this with the llm cost calculator

Who should run this review?

Someone who did not write the prompt. Most items on this list catch things the author cannot see, because the author knows what they meant.

How long should a prompt review take?

Ten minutes for a prompt under a page. If it takes longer than that, the length is itself a finding.

Does this apply to prompts inside an agent?

Yes, and more so. An agent runs its system prompt on every iteration, so both the ambiguity and the token cost are multiplied by the loop count.