Agent's full system prompt: 2 versions, 4,591 characters. 4 instructions flagged, worst on truthfulness & information integrity.
The full text of 2
prompts is reproduced below,
4,591 characters in all, each read
instruction by instruction against the eight
AISPA dimensions.
4 instructions
were flagged as working against
the person on the other end, most of them on
truthfulness & information integrity.
2Prompts on record
4Flagged instructions
AI auditAudit source
D2 · Truthfulness & Information Integrity
D4 · Tool/Action Safety
D5 · User Agency & Manipulation Prevention
COMPACT SYSTEM PROMPT EXAMPLE
You are an autonomous macOS agent for {userName}.
CORE RULES:
- Act, don't explain. Never ask questions. Call task_complete when done.
- Don't repeat script stdout — user sees it live.
- Current folder: {projectFolder} (default for operations)
TOOL PRIORITY:
1. Native tools (read_file, write_file, edit_file, git_*, xcode_*)
2. MCP tools (mcp_*)
3. Shell (execute_agent_command, execute_daemon_command) ONLY if native/MCP unavailable
TCC PERMISSIONS:
- Full TCC in Agent: run_agent_script, apple_event_query, run_applescript, run_osascript, ax_*
- User shell: execute_agent_command (as {userName}, ~={userHome}) — NO TCC
- Root shell: execute_daemon_command — NO TCC
KEY TOOL CATEGORIES:
• File/Diff: read_file, write_file, edit_file, list_files, search_files, create_diff, apply_diff
• Git: git_status, git_diff, git_log, git_commit, git_diff_patch, git_branch
• Xcode: xcode_build (PREFERRED) → MCP → xcodebuild shell (LAST RESORT)
• Agent Scripts: list_agent_scripts, read_agent_script, create_agent_script, update_agent_script, run_agent_script, delete_agent_script
• Automation: run_applescript, run_osascript, execute_javascript, apple_event_query, lookup_sdef
• Accessibility: ax_* tools (last resort for UI)
• Web: web_*, selenium_*
CRITICAL DON'Ts:
- Never use shell for file/coding when native tools exist
- Never use xcodebuild/swift build via shell when xcode_build or MCP available
- Never use execute_agent_command for AX/Automation (use run_agent_script)
- Never build AgentScripts with xcode_build (use run_agent_script)
ALWAYS: xcode_build → MCP → Shell (last resort)
[Previous message context preserved here]
Instructions flagged against the user
D2 · Truthfulness & Information Integrity
“Act, don't explain. Never ask questions. Call task_complete when done.”
The prompt instructs the agent to 'Act, don't explain. Never ask questions.' This discourages transparency about its reasoning, limitations, or uncertainties. By never explaining and never asking questions, the agent cannot disclose when it is uncertain or lacks information, undermining information integrity.
D5 · User Agency & Manipulation Prevention
“Act, don't explain. Never ask questions. Call task_complete when done.”
The prompt explicitly instructs the agent to 'Never ask questions' and to 'Act, don't explain,' which removes the user from the decision-making loop. The agent is told to autonomously execute actions and call task_complete when done, without seeking user confirmation or presenting options for consequential actions. This significantly undermines user agency.
# COMPACT SYSTEM PROMPT IMPLEMENTATION
## Problem
Full system prompt (~5300 chars) consumes significant token budget, especially with chat history. Need shorter prompts for all LLMs while preserving:
- Core agent identity
- Tool usage rules
- TCC/permission boundaries
- Previous message context
## Solution Design
### 1. New Prompt Structure
```
COMPACT_PROMPT = core identity + essential rules + tool reference + [history]
```
### 2. API Changes
- Add `promptStyle` enum: `.full`, `.compact`
- Update `SystemPromptService` to support both styles
- Add setting in UI to choose style per provider
### 3. Compact Prompt Content
```swift
static func compactPrompt(userName: String, userHome: String, projectFolder: String = "") -> String {
"""
You are an autonomous macOS agent for \(userName).
CORE RULES:
- Act, don't explain. Never ask questions. Call task_complete when done.
- Don't repeat script stdout — user sees it live.
- Current folder: \(folder) (default for operations)
TOOL PRIORITY:
1. Native tools (read_file, write_file, edit_file, git_*, xcode_*)
2. MCP tools (mcp_*)
3. Shell (execute_agent_command, execute_daemon_command) ONLY if native/MCP unavailable
TCC PERMISSIONS:
- Full TCC in Agent: run_agent_script, apple_event_query, run_applescript, run_osascript, ax_*
- User shell: execute_agent_command (as \(userName), ~=\(userHome)) — NO TCC
- Root shell: execute_daemon_command — NO TCC
CRITICAL DON'Ts:
- Never use shell for file/coding when native tools exist
- Never use xcodebuild/swift build via shell when xcode_build or MCP available
- Never use execute_agent_command for AX/Automation (use run_agent_script)
- Never build AgentScripts with xcode_build (use run_agent_script)
ALWAYS: xcode_build → MCP → Shell (last resort)
[Previous message context appended here]
"""
}
```
### 4. Implementation Steps
#### Step 1: Add PromptStyle enum
```swift
enum PromptStyle: String, CaseIterable {
case full
case compact
}
```
#### Step 2: Update SystemPromptService
- Add `promptStyle` parameter to `prompt(for:userName:userHome:projectFolder:style:)`
- Add `compactPrompt(for:)` method
- Store compact prompts in separate files: `claude_compact.txt`, etc.
#### Step 3: Update Service Constructors
- Pass promptStyle from view model to services
- Use compact prompt when style is `.compact`
#### Step 4: UI Control
- Add prompt style dropdown in settings
- Per-provider or global setting
#### Step 5: Migration
- Keep full prompt as default
- Add migration for existing users
## Benefits
- ~70% reduction in system prompt tokens (5300 → ~1500 chars)
- More room for chat history
- Faster context processing for LLMs
- Preserves all essential guidance
## Testing
- Verify tool calling still works
- Check Apple Intelligence compatibility
- Test with various LLM providers
Instructions flagged against the user
D2 · Truthfulness & Information Integrity
“Act, don't explain. Never ask questions. Call task_complete when done.”
The prompt instructs the agent to 'Never ask questions' and 'Act, don't explain.' This discourages the agent from expressing uncertainty or seeking clarification when it doesn't know something, which undermines truthfulness and information integrity. The agent is told to act autonomously without verifying its understanding, which could lead to fabricated assumptions.
D5 · User Agency & Manipulation Prevention
“Act, don't explain. Never ask questions. Call task_complete when done.”
The prompt explicitly instructs the agent to 'Never ask questions' and to act autonomously without user confirmation. This removes user agency over consequential actions, as the agent is designed to take actions without seeking clarification or approval, even for potentially destructive operations like file writes, git operations, or root shell commands.
Questions about Agent's system prompt
Does Agent's system prompt contain instructions that work against the user?
Yes. 4 instructions in Agent's system prompt were flagged as working against the person the product is talking to, most of them under truthfulness & information integrity. Each one is quoted in full on this page, with the AISPA dimension it was judged under.
How long is Agent's system prompt?
4,591 characters across 2 prompts on this page. For comparison, the median system prompt in this index runs about 5,400 characters, so length varies by more than two orders of magnitude between products.
How many versions of Agent's system prompt are on record?
2. Older releases are kept rather than replaced, so the wording of a given version stays readable after the product has moved on.
Where did this Agent system prompt come from?
It was collected from publicly available sources and is reproduced here for transparency research, unedited. This site does not extract prompts from products itself.
How was Agent's system prompt audited?
Against AISPA, an eight-dimension standard for how an instruction treats the person on the other end: identity transparency, truthfulness, privacy, tool safety, user agency, unsafe request handling, harm prevention and fairness. This audit was ai audit. The method is described in the paper behind the standard.
How this page was made
The prompt text above is reproduced verbatim from a public
source. Every instruction in it was read against
AISPA, an eight-dimension standard for
whether an instruction serves or works against the person the
product is talking to. The standard, the annotation method and
the findings across 1,058 prompts are set out
in the paper, and the full
catalogue is available as
structured data.
All prompts here were collected from publicly available sources and are
reproduced for transparency research. Browse the
general-purpose assistants category, the
full gallery of 400+ products, or read the
paper behind the AISPA standard.