Prompt Patterns for Security Artifacts

Use for application prompts that turn security artifacts into structured findings, triage decisions, or reports. For agent definitions, use the matching agent or extension authoring skill; for MCP tool input/output contracts, use mcp-creator.

Define the contract

Specify the artifact types, task, intended reader, allowed outputs, and how the result will be checked. For extraction or triage, define fields such as:

• artifact identifier and exact evidence locator;
• asset and observation time or version where available, kept distinct across artifacts even when product names match;
• observed text or value, separated from normalized interpretation;
• applicability conditions, status, and confidence with a short evidence-based reason;
• per-artifact missing evidence and conflicts: mark absent task-required fields as null or unknown with a reason, separately from quoted observations; never borrow another artifact's value;
• an explicit inconclusive or not assessed state for unsupported assessments;
• report language that separates observation, source claim, and inference.

Do not label a finding confirmed solely because a scanner, source, or model returned it. Treat absence of evidence as unknown unless the collection method and coverage support a negative result.

Define separately an empty extraction from a successfully inspected artifact, missing or inaccessible input, and an inconclusive assessment. Do not equate any of them with a negative finding. Require evidence for negative conclusions and define the coverage needed to support them.