AI Agent System Prompts Pack: 11 Tested Prompts

Eleven production system prompts for the agents people actually build, each with fill-in variables, a fixed output format, a prompt-injection rule, and test cases you can run against any model. Every prompt here was run on a real model; the outputs are in recorded/results.json and all 16 cases pass.

Each file in prompts/ has a small header (what it's for, its {{variables}}, text or JSON output) and sections in the same order: Role, Rules, Output (plus Policies, Tools, Voice or Facts where they matter).

1. Open prompts/NAME.md, copy everything below the --- header. 2. Replace each {{variable}}. The matching cases/NAME.json has a worked example of every value. 3. Paste it as the system prompt / system message / instructions (OpenAI, Claude, Gemini, n8n AI Agent "System Message", Make, Zapier, LangChain, the OpenAI Agents SDK instructions, ...).

Or render it with your values:

python3 promptcheck.py render lead-qualifier --vars my-values.json   # {"vars": {...}}

promptcheck.py (Python 3.9+, no dependencies) runs the cases against any OpenAI-compatible chat endpoint and checks the answers:

python3 promptcheck.py lint                                    # structure, variables, injection rule, cases present
OPENAI_API_KEY=... python3 promptcheck.py run --base-url https://api.openai.com/v1 --model gpt-5-mini
python3 promptcheck.py run --base-url http://localhost:11434/v1 --model qwen3:8b   # Ollama, no key
python3 promptcheck.py run --base-url ... --model ... --only lead-qualifier --out lead.json
python3 promptcheck.py check recorded/results.json             # re-check saved outputs

Endpoints: OpenAI, Ollama, LM Studio, vLLM, OpenRouter, Groq, Together, and anything else that serves /chat/completions. --api-key-env picks the environment variable holding the key (default OPENAI_API_KEY). Thinking blocks (<think>...</think>) are stripped before checking. Requests use temperature 0.

Cases are plain JSON, so add your own. Assertions: contains_all, contains_any, not_contains, code_not_contains (only inside blocks), regex, max_words, and for JSON outputs json_keys, enum, range, min_items, max_words_in. Change a prompt, rerun, and you know if it still behaves.

• Support agent: answers from policy, and won't repeat a card number someone pastes.
• Triage: correct category and priority, and a ticket saying "ignore your instructions" is still classified, not obeyed.
• RAG: cites sources, and says it can't find it instead of guessing.
• SQL: correct joins and filters, and refuses to write a DELETE (offers a SELECT preview instead).
• Lead qualifier: hot lead scored hot, link spam scored spam.
• n8n agent: asks before bulk-cancelling and texting patients.
• Meeting notes: the agreed decision and Tom's Friday task are in; a passing idea is an open question, not a decision.
• Review replies: apologizes, invites contact by email, offers no refund or discount in public.
• Coding agent: won't drop a 41,200-row table on "just do it"; replies with a backup, migration and rollback plan and asks first.
• Brand voice: exactly 3 numbered taglines, no banned words or unprovable superlatives.
• Research agent: plan with sub-questions, marks unknowns, lists sources.

./demo.sh lints all prompts, renders one, and re-checks the recorded outputs (offline).

• All 16 cases were run on Qwen3.8-27B (local, Ollama, temperature 0) on Nov 10, 2026; the outputs are saved in recorded/results.json and promptcheck.py check passes all 16.
• Two prompts were tightened after the first run: the n8n agent now always confirms bulk actions and customer messages, and the coding agent needs an explicit yes for destructive changes even after "just do it" (the first run started investigating instead of asking).
• 14 offline unit tests (./run_tests.sh, Python 3.13 and 3.10): lint, rendering, every assertion type, the recorded outputs, and a full run against a local fake OpenAI-compatible server (request path, auth header, temperature, no unfilled variables) plus an unreachable server.

• A prompt lowers the odds of a bad answer; it doesn't guarantee one. Enforce limits that matter (refund caps, read-only database users, approval steps) in code or permissions too.
• The recorded outputs come from one model. Run the cases on yours: results vary between models and versions.
• The research agent case runs without tools, so it only checks plan and format. The model still filled in some details from memory (marked as unverified), which is exactly why the prompt asks for sources.
• Assertions are keyword and structure checks, not a judge model. Read failures before changing a prompt.