ENGINEERING PROMPT CATALOG28 prompts. Bounded work.
Reusable starting points for investigation, implementation and specialist review. Replace task-specific context, inspect the generated request, and require evidence.
No prompts match. Try another term or reset the filters.
Repository AnalysisInitial Codebase Mapping & Dependency Audit
Analyze an unfamiliar repository structure, key dependencies, and configuration baseline without making edits.
When to use: Use when onboarding Codex to an existing repository or before beginning a major architectural initiative.
Analyze this repository to establish an architectural baseline.
CRITICAL DIRECTIVE: Do NOT modify any files.
1. Inspect `package.json` (or equivalent lockfiles/manifests) to identify core frameworks, build tools, and test libraries.
2. Map the top-level directory layout and locate main entry points (e.g. server entry, client index, routing tables).
3. Check for environment configuration templates (.env.example) and identify external service dependencies.
4. Report:
- Tech stack summary & versions
- Architecture pattern (MVC, modular, monorepo, etc.)
- Test suite runner and verification commands
- Potential friction points or missing configs
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Staged Feature Implementation with Contract Boundary
Implement a new feature incrementally with strict preservation of existing interfaces.
When to use: Use when adding new endpoints, components, or modules to an established application.
Implement the following feature requirement in staged phases:
Feature: [Specify feature name, e.g., Rate Limiting on API Endpoints]
Requirements:
1. [Requirement 1: e.g. Limit unauthenticated requests to 60 per minute per IP]
2. [Requirement 2: e.g. Return HTTP 429 Too Many Requests with Retry-After header]
3. [Requirement 3: e.g. Store rate counters in Redis with sliding window expiration]
Execution Rules:
- Phase 1: Inspect existing middleware in `src/middleware/` and propose implementation plan. Do NOT edit files yet.
- Phase 2: After plan approval, implement the middleware and export standard types.
- Phase 3: Write comprehensive unit tests covering standard, boundary, and overflow limits.
- Phase 4: Run automated test suite and provide command proof.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Root-Cause Diagnosis from Stack Trace & Reproduction
Isolate the root cause of a defect by analyzing stack traces and reproduction conditions before touching code.
When to use: Use when investigating intermittent errors, exceptions, or unexpected state transitions.
Investigate the following software defect.
Symptom:
[Paste exact error message or unexpected behavior here]
Reproduction Steps:
1. [Step 1]
2. [Step 2]
Investigation Protocol:
1. Do NOT modify any code yet.
2. Inspect the files cited in the stack trace.
3. Trace data flow leading to the null reference / exception.
4. Explain why the failure occurs under these specific inputs.
5. Present a proposed fix and specify which unit test will prove the regression is resolved.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Responsive Layout Refinement & Overflow Elimination
Fix visual defects and responsive breakpoints without breaking component logic.
When to use: Use when auditing mobile responsiveness or correcting layout shifts on high-density displays.
Audit and fix responsive layout defects in `[Target Component/Page]`.
Requirements:
- Support viewports: 375px (mobile), 768px (tablet), 1280px (desktop), 1920px (widescreen).
- Eliminate horizontal scrollbars (`overflow-x: hidden` hacks are prohibited; fix underlying flex/grid widths).
- Ensure touch targets are at minimum 44x44px on touch viewports.
- Maintain keyboard tab order and visible `:focus-visible` styling.
Protocol:
1. Inspect current CSS/SCSS/Tailwind rules in target files.
2. List elements causing overflow or illegibility.
3. Propose minimal CSS adjustments.
4. Do not touch state management or API data fetching.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Database Query & Computational Bottleneck Audit
Identify N+1 query patterns, excessive allocations, and latency hotspots.
When to use: Use when API endpoints or UI rendering cycles exhibit measurable slowdowns.
Perform a rigorous performance audit on `[Target Function/Endpoint]`.
Objective: Identify execution bottlenecks and reduce response time.
Review Checklist:
1. N+1 database queries or unindexed lookups.
2. Synchronous blocking operations in asynchronous event loops.
3. Unnecessary deep cloning or excessive memory allocations.
4. Unmemoized high-frequency re-renders or unpaginated list requests.
Output:
- Deliver an audit table: [Location | Root Cause | Estimated Impact | Proposed Optimisation]
- Do not edit files until we select which optimization to apply.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
OWASP Top 10 Vulnerability & Input Sanitization Audit
Audit source code for injection vectors, insecure direct object references, and authentication flaws.
When to use: Use before merging PRs touching authentication, payments, data ingestion, or user uploads.
Conduct a security review of `[Target Directory/Files]`.
Scope:
- Injection vectors: SQL, NoSQL, OS command, and template injection.
- Authentication & Session: Broken authorization, IDOR, token validation, CSRF protections.
- Secrets & Logging: Ensure credentials, private keys, and sensitive PII are never logged to stdout.
- Input Validation: Verify schema validation boundaries (e.g. Zod, Joi, class-validator) on all untrusted input.
Rule: Do not rewrite files. Deliver a classified findings report (High/Medium/Low) with specific remediation snippets.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
WCAG 2.2 AA Compliance & Keyboard Navigation Review
Audit markup and interactive controls for screen reader support and keyboard operability.
When to use: Use on user-facing web applications to identify and correct accessibility barriers.
Audit `[Target View / Component]` for WCAG 2.2 AA compliance.
Checklist:
1. Semantic HTML: Ensure appropriate landmarks (`<header>`, `<nav>`, `<main>`, `<footer>`), valid heading hierarchy (H1 -> H2 -> H3).
2. Keyboard Accessibility: All interactive controls must be reachable via Tab, operable via Space/Enter, with clear `:focus-visible` rings.
3. ARIA Usage: Ensure `aria-expanded`, `aria-label`, and `aria-hidden` are used strictly where native HTML is insufficient.
4. Color Contrast: Text contrast ratio >= 4.5:1 for standard text; 3:1 for large text.
5. Motion: Ensure animations respect `@media (prefers-reduced-motion)`.
Report findings before proposing markup patches.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Comprehensive Unit & Integration Test Suite Generation
Write robust tests covering happy path, negative inputs, and boundary conditions.
When to use: Use when establishing test coverage for legacy functions or new features.
Write a comprehensive test suite for `[Target File/Module]` using `[Test Framework, e.g., Jest / Vitest / Pytest]`.
Coverage Requirements:
1. Happy Path: Standard expected inputs producing valid outputs.
2. Boundary Cases: Empty arrays, null/undefined inputs, 0, max integer values, unicode strings.
3. Error & Exception Paths: Network failures, invalid payload schemas, unauthorized responses.
4. Isolation: Properly mock external network, database, or filesystem side-effects.
Directive: Run the test suite via CLI and print the complete execution output proving 100% pass rate.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Behavior-Preserving Clean Refactoring
Modernize and simplify legacy code without altering external observable behavior.
When to use: Use to reduce cognitive complexity, decompose large functions, or eliminate duplicate code.
Refactor `[Target File/Module]` to improve maintainability and readability.
CONSTRAINTS:
- Preserves 100% of existing behavior and external API signatures.
- Do NOT alter exported function names, parameter shapes, or return types.
- Run existing tests before making any edits to establish a green baseline.
- Perform refactoring in small, reviewable steps; commit only within the authorized scope.
- Re-run test suite after each atomic step to check for regressions.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Pre-Release Verification & Production Build Audit
Verify that all linting, type-checking, automated tests, and production build pipelines pass.
When to use: Use before tagging releases or submitting final pull requests.
Audit this repository for release readiness.
Execute and report the following verification pipeline:
1. Lint check (e.g. `npm run lint`): Confirm zero errors and zero warnings.
2. Type check (e.g. `npx tsc --noEmit`): Confirm clean compile.
3. Automated tests (e.g. `npm test`): Run full test suite; confirm 100% pass.
4. Production build (e.g. `npm run build`): Verify output bundle size and exit code 0.
5. `git status`: Confirm no untracked or dirty temporary files exist.
Deliver the final completion status report.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Browser Verification & Console Error Scrubbing
Validate frontend behavior across browser engines, verifying zero console warnings.
When to use: Use when building single-page applications or static web products.
Verify frontend implementation for `[Target URL / Route]`.
Checks:
1. Verify development server compiles cleanly without deprecation warnings.
2. Inspect browser developer tools console: Ensure zero unhandled promise rejections, zero 404 resource errors, and zero CSP violations.
3. Test network tab: Verify API payloads are compressed and headers include appropriate cache controls.
4. Measure layout shift during initial render and report the conditions.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
System Boundary & Dependency Decoupling Review
Evaluate modularity, circular dependencies, and service boundaries across modules.
When to use: Use when designing system expansions or refactoring tightly coupled legacy code.
Perform an architectural review of the relationship between `[Module A]` and `[Module B]`.
Evaluation Criteria:
1. Dependency Direction: Does business logic depend on database infrastructure, or vice versa?
2. Circular Dependencies: Identify any import loops or recursive module requirements.
3. Single Responsibility: Is each module focused on one domain capability?
4. Propose an architectural diagram (using text/markdown) illustrating how to decouple the subsystems.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Role: Senior Software Architect
Directs Codex to evaluate long-term maintainability, structural boundaries, and technical trade-offs.
When to use: Use at the outset of complex projects or before initiating significant structural changes.
Act as a Senior Software Architect.
Your mandate is long-term stability, clear system boundaries, and maintainability. You prioritize simplicity and proven design patterns over trendy abstractions.
Rules of engagement:
1. Do not modify files yet. Investigate first.
2. Map the data contracts, dependencies, and state boundaries.
3. Identify technical debt, scalability risks, and operational trade-offs.
4. Present an architectural assessment with concrete options and recommendations.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Role: Senior Bug Investigator
Directs Codex to perform methodical causal debugging rather than guessing at fixes.
When to use: Use when debugging race conditions, memory leaks, or tricky edge-case bugs.
Act as a Senior Bug Investigator.
Your mandate is rigorous root-cause analysis. You do not guess, apply superficial workarounds, or add arbitrary sleep delays.
Rules of engagement:
1. Do not modify files yet. Investigate first.
2. Formulate testable hypotheses based on stack traces, reproduction logs, and source inspection.
3. Trace data mutations through the execution path until the exact point of divergence is proven.
4. Propose a precise fix that eliminates the root cause and specify an automated regression test.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Role: Principal Security Reviewer
Directs Codex to audit code from an adversarial threat-modeling perspective.
When to use: Use to audit authentication, authorization, cryptography, and input handling.
Act as a Principal Security Reviewer.
Your mandate is defense-in-depth, zero-trust validation, and protection of user confidentiality and data integrity.
Rules of engagement:
1. Do not modify files yet. Investigate first.
2. Audit all external attack surfaces: API endpoints, websocket handlers, CLI inputs, query params.
3. Review token validation, cryptographic algorithms, session lifetimes, and secret exposure.
4. Provide an impact-assessed findings table with actionable remediation instructions.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Role: Staff QA / Test Engineer
Directs Codex to design adversarial test plans, boundary conditions, and end-to-end verification.
When to use: Use to ensure complete test coverage and uncover hidden edge-case regressions.
Act as a Staff QA / Test Engineer.
Your mandate is system reliability and regression prevention. You assume code will break under adversarial inputs, concurrent access, and network partitions.
Rules of engagement:
1. Inspect existing test suites and identify coverage gaps.
2. Design test matrices: null/undefined checks, boundary limits, concurrency, and malformed inputs.
3. Implement deterministic automated tests that run quickly and reliably in CI.
4. Verify tests fail when the bug is present and pass when resolved.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Role: Performance & Systems Engineer
Directs Codex to optimize throughput, memory usage, and algorithm efficiency.
When to use: Use when optimizing CPU-heavy tasks, database queries, or network bottlenecks.
Act as a Senior Performance Engineer.
Your mandate is throughput, latency minimization, and resource efficiency. You make decisions based on profiling data and Big-O algorithmic complexity, not intuition.
Rules of engagement:
1. Do not modify files yet. Profile and analyze first.
2. Identify hot paths, redundant memory allocations, unindexed queries, and blocking I/O.
3. Propose optimizations with estimated complexity improvements (e.g. O(N^2) to O(N)).
4. Provide benchmark commands to objectively measure latency before and after changes.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Role: Senior Accessibility (a11y) Reviewer
Directs Codex to audit and remediate markup for WCAG 2.2 AA standards.
When to use: Use when building or auditing web UIs for screen-reader and keyboard accessibility.
Act as a Senior Accessibility (a11y) Engineer.
Your mandate is inclusive access and compliance with WCAG 2.2 AA standards. You treat accessibility as a core engineering requirement, not an afterthought.
Rules of engagement:
1. Audit DOM landmarks, header hierarchy, and ARIA attributes.
2. Verify keyboard navigability: tab stops, focus rings, and escape handling.
3. Check color contrast ratios and responsive zoom up to 200%.
4. Deliver compliant markup that works naturally with assistive technologies.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Role: Lead Release Engineer
Directs Codex to verify deployment manifests, changelogs, and build artifacts.
When to use: Use when preparing production releases and verifying deployment packages.
Act as a Lead Release Engineer.
Your mandate is release safety, reproducible builds, and operational predictability.
Rules of engagement:
1. Audit the git working tree for uncommitted artifacts or untracked temporary files.
2. Run production compilation and verify artifact hashes.
3. Ensure semantic versioning and changelog entries accurately reflect the diff.
4. Check deployment configuration scripts and environment documentation.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Role: Refactoring & Technical Debt Specialist
Directs Codex to modernize codebases without changing external functionality.
When to use: Use when reducing code complexity, breaking up monoliths, or modernizing syntax.
Act as a Refactoring Specialist.
Your mandate is code cleanliness, modularity, and technical debt reduction while preserving 100% of existing behavior.
Rules of engagement:
1. Do not modify files until existing tests pass green.
2. Decompose large methods into small, pure, single-purpose functions.
3. Eliminate duplicate logic and simplify branching conditions.
4. Run automated tests after every incremental edit to check for regressions.
Evidence requirements: Read applicable AGENTS.md and inspect the relevant code first. Use repository-defined commands, not assumed scripts. Preserve unrelated user work. Cite files and observations; distinguish confirmed findings from hypotheses. Report checks actually run and any unverified macOS or architecture targets.
Audit dependencies against actual reachability
Inspect manifests, lockfiles, runtime constraints and package sources.
When to use: Before changing a lockfile or responding to an advisory.
Inspect manifests, lockfiles, runtime constraints and package sources. Use the ecosystem’s supported audit tool after reviewing its network and script behavior. Separate runtime from development dependencies and verify whether vulnerable code is reachable. Propose the smallest compatible upgrade, inspect release notes and run relevant checks. Do not run a force-upgrade or regenerate all dependencies.
Read applicable project instructions first. Preserve unrelated changes. Cite evidence and report exact verification coverage and limitations.
Make setup documentation reproducible
Compare README, AGENTS.md and architecture notes against actual files and commands.
When to use: When onboarding or after tooling changes.
Compare README, AGENTS.md and architecture notes against actual files and commands. Identify stale setup steps, missing services and undocumented runtime versions. Verify volatile facts against primary documentation. Update the affected instructions, distinguish examples from supported commands, and disclose any setup path you could not execute.
Read applicable project instructions first. Preserve unrelated changes. Cite evidence and report exact verification coverage and limitations.
Review the complete proposed diff
Inspect git status, unstaged and staged diffs, and relevant untracked files.
When to use: Before committing or opening a pull request.
Inspect git status, unstaged and staged diffs, and relevant untracked files. Trace changed behavior through callers and tests. Look for regressions, secrets, unintended generated files and unrelated edits. Cite each finding with its path, consequence and verification. Do not stage, commit, discard or publish changes during this review.
Read applicable project instructions first. Preserve unrelated changes. Cite evidence and report exact verification coverage and limitations.
Audit Mac filesystem, shell and security behavior
Inspect scripts for shell assumptions, GNU-only flags, unquoted paths, filename case, executable modes and symlinks.
When to use: When porting a project to macOS.
Inspect scripts for shell assumptions, GNU-only flags, unquoted paths, filename case, executable modes and symlinks. Review CLT requirements, privacy access and Gatekeeper handling. Separate Unix permissions from macOS security policy. Propose targeted changes; do not disable protections globally. Verify on macOS when available and explicitly distinguish emulation from native results.
Read applicable project instructions first. Preserve unrelated changes. Cite evidence and report exact verification coverage and limitations.
Trace the complete arm64 dependency chain
Inspect executable paths, uname output, translated-process status and binary architecture.
When to use: When a build fails on an Apple Silicon Mac.
Inspect executable paths, uname output, translated-process status and binary architecture. Trace native Node modules, Python wheels, Rust targets, shared libraries and embedded helpers. Do not assume /usr/local is native ARM. Prefer supported arm64 or Universal artifacts; isolate any justified Intel/Rosetta dependency. Propose a reproducible native build and report what was tested.
Read applicable project instructions first. Preserve unrelated changes. Cite evidence and report exact verification coverage and limitations.
Validate the x86_64 support boundary
Inspect minimum OS settings, x86_64 binaries and native dependency support.
When to use: Before promising support for Intel Macs.
Inspect minimum OS settings, x86_64 binaries and native dependency support. Verify package-manager support tiers and vendor release availability; do not treat Apple Silicon success as Intel coverage. Identify the oldest supported Intel environment from project policy and build configuration. Report release blockers and untested targets without inventing compatibility.
Read applicable project instructions first. Preserve unrelated changes. Cite evidence and report exact verification coverage and limitations.
Review a Mac release artifact
Inspect the existing packaging pipeline, CPU targets, minimum OS, embedded libraries, signing identities and entitlements.
When to use: Before distributing a Mac CLI or application.
Inspect the existing packaging pipeline, CPU targets, minimum OS, embedded libraries, signing identities and entitlements. Verify current Apple signing and notarization guidance. Test installation, launch, update and uninstall on the intended Mac targets. Keep signing secrets out of logs. Produce a bounded release plan; do not sign or publish beyond the authorized scope.
Read applicable project instructions first. Preserve unrelated changes. Cite evidence and report exact verification coverage and limitations.
Find evidence-backed defects in a bounded area
Inspect the selected module, its callers and tests.
When to use: When reviewing an existing module without a known reproduction.
Inspect the selected module, its callers and tests. Trace invariants, error handling, cancellation and concurrency. Produce minimal reproductions for confirmed defects. Rank findings by user impact and confidence. Separate speculation from observed failures. Do not rewrite the module; propose focused fixes and meaningful regression checks.
Read applicable project instructions first. Preserve unrelated changes. Cite evidence and report exact verification coverage and limitations.