What the System Prompt Linter does
This linter reads a system prompt and reports contradictory instructions, conflicting length limits, several competing "top priorities", vague wording, repeated rules, unfilled placeholders, credentials and a missing output format - each with the line numbers that triggered it and a score built from published rule weights.
It is a set of fixed, deterministic rules running in your browser, not an AI reviewer: the same prompt always gives the same findings, nothing is sent to any model, and every rule says whether it comes from the providers' prompting guidance, security practice or an A2Z heuristic. That makes it useful in review, before a prompt change ships, and useless as proof that a prompt works - only testing does that.
How to use it
- Paste the system prompt, or load an example to see the rules fire.
- Press Check prompt. The score and counts appear, followed by findings ordered problems first, each with its line numbers and the reason it matters.
- Fix problems before warnings: a contradiction or a leftover placeholder changes behaviour; vague words and emphasis usually only blunt it.
- Read the structure outline. A long prompt without named sections is hard for people to review and for a model to follow; headings or XML-style tags help both.
- Copy the report as Markdown for a pull request, or download CSV or JSON to track findings across versions.
Reading the results
Problems (15 points each) are patterns that change what the model does: always X on one line and never X on another, a minimum length above the maximum, a placeholder that will be sent literally, a key in the prompt, no output format at all.
Warnings (6 points) are ambiguity the model must resolve by guessing: two things both called most important, two different maximums, two output formats, no role, near-duplicate instructions. Notes (2 points) are style: vague words, heavy capitals, mostly negative rules, no fallback for questions it cannot answer.
The score is 100 minus those weights, floored at zero. It is a way to compare versions of the same prompt, not a grade to compare different prompts, and a clean result means only that none of these patterns appears.
Worked example: the "prompt with problems" example
The example prompt has 17 lines. It says "Always use bullet points." on line 6 and "Never use bullet points when the user writes casually." on line 7 - a contradiction unless the exception is made explicit. Line 8 caps replies "under 100 words" while line 9 asks for "at least 150 words" for technical questions, which cannot both hold. Line 12 still contains "[INSERT PRODUCT NAME]".
Those are three problems (45 points). Lines 3 and 4 each claim to be the most important rule and no sentence says who the model is: two warnings (12 points). Five notes follow: no instruction for when the model cannot answer, capitals and exclamation marks on lines 1 and 12, and the vague words "appropriate", "try to" and "nice" on line 11 (10 points). 100 - 45 - 12 - 10 = 33.
The well-structured example - a role, scoped rules, a fallback, data delimiters and an output contract of at most 120 words - triggers no rule and scores 100.
How the contradiction rule works - and misses
Sentences are split into positive instructions (always, must, should, make sure to) and negative ones (never, do not, avoid, must not). The first two content words after the keyword, lightly stemmed, form a key; the same key on both sides is reported. "Always use bullet points" and "Never use bullet points" share the key "use bullet".
That catches the common editing accident where a new rule is added without removing the old one, but it cannot understand meaning. "Be concise" against "Explain every step in detail" is a real conflict with no shared words, and a legitimate exception ("never use bullets in casual chat") is flagged until you merge it into one rule that states when each applies.
Limitations: what the result does not prove
- Rules match patterns, not meaning. Conflicts phrased in different words are missed, and deliberate exceptions can be flagged.
- A clean result is not evidence that the prompt produces good answers. Evaluate it against real inputs and expected outputs.
- English wording only: the vague-word, negative-instruction and priority rules look for English phrases.
- Credential detection covers common key formats and key=value pairs; it cannot find every secret, and a finding may be a harmless example string.
Privacy: where your data goes
Everything you paste, type or drop is processed in this browser tab. It is not uploaded, logged, stored or sent to analytics. Session recording and tag-manager scripts are switched off on this page.
Standards and sources
- Anthropic - Prompting best practices
- OpenAI - Prompt engineering guide
- Google - Prompt design strategies (Gemini API)
- OWASP - LLM07 System prompt leakage
Frequently asked questions
Does the linter send my prompt to an AI model?
No. Every check is a fixed rule written in JavaScript and run in your browser. The same prompt always produces the same findings, which is what you want in a review step - and it means confidential prompts never leave your machine.
Why does the linter want an output format?
Because without one the model chooses length, structure and tone for itself, and that choice drifts between requests and model versions. All three major providers' prompting guides recommend stating the expected format explicitly; it is also what makes answers testable.
Are capital letters and IMPORTANT tags bad in a system prompt?
Not wrong, but rarely needed with current models, which follow calm, specific instructions closely. Anthropic's guidance notes that heavy emphasis written for older models can make newer ones over-apply a rule. Explaining why a rule matters usually works better than shouting it.
Why is telling the model what not to do flagged?
Only when negative rules outnumber positive ones. Instructions like "do not use lists" name the unwanted behaviour without saying what to do instead; "write in flowing paragraphs" is usually followed more reliably. Keep the prohibitions that are genuinely safety or policy limits.
What score should a production system prompt get?
Aim for no problems at all and a short list of warnings you have read and accepted. The number itself matters less than the trend: lint each version before release and look at what changed, alongside your evaluation results.
Can I put API keys or passwords in a system prompt if users cannot see it?
No. System prompts can often be coaxed out by users through prompt injection, and they appear in logs and traces. Keep credentials in your server code and pass the model only the data it needs; the linter flags common key formats for that reason.
Last reviewed by the A2Z.Tools team against the sources listed above.
