prompt-instruction-framing

name

prompt-instruction-framing

description

Audit LLM prompt strings (system prompts, instruction templates, tool descriptions, agent instructions) along two axes — Direction (positive vs. negative phrasing) and Prescriptiveness (directorial framing vs. enumerated palette / choose-from list) — and propose reframings that shape how the LLM thinks rather than what it must choose. Use when reviewing prompt files, when prompts have grown long with prohibition lists or option taxonomies, when prompt shells may override committed section prompts or final authored artifacts, when output is brittle (LLM ignores rules, defaults to safe bland choices, or cycles through a checklist), or when adding/refactoring prompt instructions. Recognizes legitimate enumeration cases (validated enums, provider-required values, safety/refusal contexts, image-gen negative_prompt input, legal exclusions) and skips them with a note.

Prompt Instruction Framing Audit

Use this skill when an LLM prompt fails one of two structural tests:

1. It tells the model what not to do instead of what to do — negative framing (Direction axis).
2. It hands the model a closed list to choose from instead of priming the role and context that would let the model produce contextual choices itself — prescriptive framing (Prescriptiveness axis).

Both are sub-patterns of one parent principle:

A prompt should shape how the LLM thinks, not enumerate what it must choose.

When the prompt shapes thinking, the model produces contextual, varied, and well-judged output. When the prompt enumerates choices — whether by prohibiting items or by listing approved ones — the model optimizes for satisfying the menu and stops authoring.

This skill audits along both axes, flags candidates, recognizes legitimate exceptions, and proposes reframings. It does not autofix.

Also run an authority-boundary check when a prompt is a shell around smaller committed units. Producer shells, wrapper prompts, job envelopes, adapter prompts, and orchestration prompts may frame role, assembly, IDs, sequencing, provider limits, and transport. They should not carry creative, continuity, policy, business, or product authority that belongs in committed section prompts, item prompts, source clauses, tasks, or final authored artifacts.

The two axes (orthogonal — a prompt can fail one or both)

Axis	Smell shape	Cured shape
Direction	"Do not X / Never X / Avoid X / Refrain from X"	"Always Y / Use Y / Continue with Y"
Prescriptiveness	"Choose from this palette: A, B, C, D, E" / "Reach for one of these techniques" / long enumerated taxonomies for subjective qualities	"You are a cinematographer staging this scene. Multiple cameras cover the action; choose the vantage each moment earns." (set the role + context; trust the model's vocabulary)

A prompt can be:

• Positive-direction AND non-prescriptive ← target shape.
• Positive-direction BUT prescriptive (the cinematographer-vocabulary trap).
• Negative-direction AND non-prescriptive (rare — usually drifts into prescription).
• Negative-direction AND prescriptive ("Don't choose from these: A, B, C") — double smell.

The audit handles each axis with its own taxonomy and its own carve-outs.

Authority Boundary Check — shells are not source of truth

Some prompt failures are not mainly negative or prescriptive. They happen because the wrong prompt layer is authoritative.

Reusable rule:

• The committed section/item prompt or final authored artifact is binding for that unit.
• The shell carries logistics, assembly, and transport.
• If the shell needs creative, continuity, policy, business, or product instruction to make the output correct, repair the committed unit prompt or its canonical write path.

This is portable beyond media prompts. The same boundary applies to email campaign sections, legal clauses, support replies, workflow tasks, dashboard copy blocks, agent tool packets, and any system where an outer envelope wraps smaller committed units. The wrapper should assemble and deliver the unit's binding prompt, not reinterpret it.

Smell shape:

• a producer shell says "maintain continuity with X" while the committed section prompts are supposed to own continuity
• an adapter prompt adds creative direction after a user-approved prompt exists
• tests assert that the wrapper contains the right idea but never prove the provider/worker binds to the committed unit prompt
• a generic shell rescues under-specified section prompts instead of fixing those prompts upstream

The correction is usually not another wrapper instruction. Move the binding instruction into the committed unit prompt/artifact and keep the shell neutral.

The empirical case

Direction (Anthropic + EMNLP):

• Anthropic prompt-engineering best practices: "Positive examples ... tend to be more effective than negative examples or instructions."
• "Improving Negation Reasoning in Large Language Models" (EMNLP Findings 2025): persona / warning prompts that direct attention to negation gain 10–25% accuracy.
• "Negation: A Pink Elephant in the Large Language Models' Room?" (2025): frontier models still inconsistent on negation; the gap does not reliably close with model size.
• Mechanism: pink-elephant / mention-amplification, attention instability around negation tokens, training distribution skew positive.

Prescriptiveness (operational evidence + observable failure mode):

• LLMs given a closed list of options tend to satisfy the menu rather than author contextually — "feel obligated to use multiple vantages even when one held vantage is the right answer."
• A rich role + context produces vocabulary that an enumerated palette would have to replicate (and inevitably underspecifies) — wasted prompt budget plus a maintenance burden.
• Long taxonomies become checklists; the LLM cycles through them mechanically. Output reads as cataloged, not directed.
• Industry pattern in some prompt-engineering circles: underspecification beats over-specification when the model has the right role and context.

Across providers, the Direction axis is documented (Anthropic) but not consistently codified. The Prescriptiveness axis is even less documented and is essentially an unaddressed gap. A per-repo audit on both is high-leverage.

---

Dimension 1 — Direction (positive vs. negative)

LLMs follow positive instructions more reliably than negative ones. Telling the model what to do gives next-token prediction a target distribution. Telling it what not to do asks the model to perform a separate suppression operation it does inconsistently. Plus the pink-elephant effect: naming a concept to suppress it can activate the same attention pathways as naming it to produce it.

Carve-outs (skip these — negation is correct here)

1. Image-generation negative_prompt as a separate technical input. Stable Diffusion / SDXL take negatives via classifier-free guidance — subtracts unconditional embeddings rather than parsing natural-language negation. If the negation belongs in a negative_prompt parameter, that's correct. The smell is when negation appears in the positive prompt prose alongside the rest of the instruction. Note: Flux notably does NOT have effective negative prompts (no CFG, uses flow matching at scale=1) — for Flux, even the dedicated parameter is suspect.

   Detection markers: negative_prompt, negativePrompt, neg_prompt, negativePromptDoc. File paths like *image-generation* / *sdxl* / *stable-diffusion* / *flux*.

2. Safety / refusal / constitutional training contexts. Anthropic's RLAIF approach uses explicit "do not provide guidance on harmful pathogens"-type prohibitions to train refusal behaviors. Negation here is deliberate and effective.

   Detection markers: safety, refusal, constitution, guardrail, moderation, harmful. Constants named REFUSAL, SAFETY_PROMPT, BLOCKLIST, HARMFUL_CONTENT.

3. Jailbreak resistance / hardcoded refusal vocabulary. Negative-phrased rules ("Do not assist with illegal acts") outperform positive-only equivalents because they target concentrated refusal patterns and harden them against adversarial drift.

   Detection markers: same as (2) plus abuse, attack, adversarial, red_team, redteam, prompt_injection.

4. Legal / regulatory exclusions with named entities. Compliance contexts (EU AI Act deepfake provisions, U.S. state laws on AI-content disclosure, copyright/likeness) require named prohibitions for enforceability. Positive reframing cannot carry the legal weight.

   Detection markers: compliance, legal, prohibited_entities, protected, regulatory, gdpr, eu_ai_act, dsa.

If a flagged prompt is in one of these categories, surface as Carve-out — verify with the matching marker.

Reframing taxonomy

Negative shape	Class	Positive reframe pattern
"Do not X" / "Never X"	Prohibition	"Always Y" / "Use Y" / "Choose Y"
"Avoid X" / "Without X"	Exclusion	"Use Y" / "Render in Y style"
"Stop X" / "Refrain from X"	Cessation	"Continue with Y only"
"Don't include X" / "Omit X"	Restraint	"Include only Y"
"No X" (where X is a stated constraint)	Constraint	"Use Y" — but check Dimension 2 to avoid replacing one smell with another
Image gen: "no real-person likeness" (in main prompt)	Exclusion	"Stylized fictional rendering" — OR move the exclusion to the negative_prompt parameter

Concrete examples:

• "Do not uppercase names" → "Always lowercase names"
• "Don't be verbose" → "Keep responses under 3 sentences"
• "Never use jargon" → "Use plain language a 12-year-old understands"
• "Avoid placeholder text" → "Use the resolved asset name where a placeholder would otherwise go"
• "Don't include personal opinions" → "Stick to factual statements supported by the source"

For taste-shaped rules ("avoid generic prose"), the reframe is incomplete on its own. Recommend additionally: add 1–2 positive examples, tighten the field name / schema description, or move the subjective check to telemetry. Cross-reference Dimension 2 — many "avoid generic" reframes drift into prescriptive palettes that are themselves the next smell.

---

Dimension 2 — Prescriptiveness (directorial framing vs. enumerated palette)

Even positive-framed instructions fail when they hand the model a closed list to choose from for a subjective quality. The list becomes a cage:

• The LLM optimizes for "satisfying the menu" rather than authoring contextually.
• Output reads as cataloged rather than directed.
• The list becomes a maintenance burden — every domain expansion requires editing the list.
• The LLM's own vocabulary, primed by the right role, would have produced contextual choices the list can't anticipate.

The diagnostic test (run this on any flagged prompt):

Does this list create pressure on the LLM to use items from it?

If yes, the list is the cage. If the LLM, given the right role and context, would produce contextual vocabulary that includes (or doesn't include) the list items as the action calls for, the list is unneeded.

Smell shapes

• "Choose from this palette: A, B, C, D, E" / "Reach for one of these: ..." (closed list)
• "Use one of: technique_1 | technique_2 | technique_3" for a subjective quality
• Long enumerated taxonomies for vantages, tones, moods, styles, framings, emotions — where the LLM with the right role would produce contextual vocabulary itself
• Bullet lists in the prompt where each bullet is a discrete option to pick rather than a dimension to consider
• "When X happens, use Y" rule chains for nuanced authoring decisions
• Vocabulary blocks framed as [FOO REFERENCE] / [BAR PALETTE] / [VOCABULARY] for subjective dimensions
• Multi-axis menus ("vantage axis: A/B/C/D; motion axis: P/Q/R/S") that look comprehensive but force enumeration

The cure pattern

1. Set the ROLE that primes the right thinking. "You are a cinematographer staging a 15-second scene." "You are a senior policy editor reviewing this draft for clarity." The role activates the vocabulary the LLM already has.
2. Set the CONTEXT that gives the model what it needs. The brief, the asset inventory, the structural constraints, the user's intent. Context is the input to the role's thinking; the palette is a substitute for it.
3. Trust the model's vocabulary that follows from role + context. A cinematographer LLM produces "low-angle tracking shot" or "drone pull-back" when the action calls for it — without being given a list of vantages to pick from.
4. Use examples sparingly — illustrate the kind of thinking, not a checklist of allowed answers. If you find yourself writing more than 2–3 examples for a subjective quality, they're becoming a checklist.
5. When you find yourself writing a palette of 4+ items for a subjective quality, ask: "If the role were richer, would the LLM produce these items itself?" Usually yes.

Carve-outs (skip these — enumeration is correct here)

The Dimension 2 carve-outs are different from Dimension 1's. Enumeration is legitimate when:

1. Validated allowlist / structural enum. The consumer code parses one of N exact strings. Examples: dramaticBeat: "setup" | "confrontation" | "resolution", framingTechniqueId from a database table, aspectRatio: "16:9" | "9:16" | "1:1". The enumeration is the contract; not a smell.

   Detection markers: Zod z.enum([...]), TypeScript union types, ID columns with foreign-key constraints, enum schemas in validators.

2. Provider-required values. API requires fixed values (model IDs, durations, resolutions, aspect ratios from a provider's supported list). The list is not a guidance choice; it's a transport contract.

3. Tool / function selection. The LLM must pick from known tool names. Available tools form a legitimate enumerated input.

4. Safety-critical refusal categories. Explicit lists of refused content types are part of the safety contract (overlaps with Dimension 1 carve-out 2/3).

5. Domain-vocabulary teaching for novice or fine-tuned models. When the base model genuinely lacks vocabulary for a domain (rare for frontier models on common subjects), a brief teaching list can help. Mark as compatibility carve-out — note when the base model gains the vocabulary, the list should be removed.

6. Step-by-step procedural workflows. When the LLM must execute a fixed sequence of steps (e.g., a structured agent workflow), the steps are procedural, not subjective. Enumeration of steps is correct.

The smell is enumeration of subjective qualities — taste, tone, mood, vantage, style, emotion, vocabulary register, narrative beat — where the model with the right role + context could produce contextual choices.

Reframing examples

The cinematographer block (canonical example):

❌ Smell shape (positive in direction, prescriptive in structure):

[VANTAGE VOCABULARY]
WHERE THE CAMERA STANDS:
- Ground-level / low-angle: power, threat, scale beneath the subject
- Eye-level: dialogue, decisions, intimate physicality
- High-angle / overhead: vulnerability, surveillance, geographic reveal
- Wide / area view: establishment, traversal, scale of place
- Aerial / drone: terrain reveal, scale of arrival or departure

HOW THE CAMERA MOVES:
- Locked-off: stillness conveys ritual...
- Handheld: urgency, subjectivity, instability
- Push-in: tightening, emotional emphasis
- Pull-back: scale shift, revelation
- Dolly / tracking: motivated traversal alongside the subject
- Cut between angles: time compression and action assembled

Choose the vantage and motion each beat earns.

✅ Cure shape (set the role; trust the vocabulary):

[ROLE]
You are directing a 15-second cinematic scene. A scene is shot from
multiple cameras, each watching the action from where it serves the
moment best. Your job is to stage the action — name the camera vantage
and motion at each percentage window so the provider model renders the
intended cinema, not a default eye-level take.

The role does the work the palette tried to do. The cinematographer LLM, primed by "directing", "multiple cameras", "vantage", "stage the action", produces "low-angle tracking", "drone pull-back", "cut to high overhead" when the action calls for them — without being told those exist as choices. The palette would have had to anticipate every vocabulary item; the role activates the vocabulary the LLM already has.

Common reframings:

• "Choose a tone from: warm, neutral, cool, urgent" → "Adopt the tone the moment earns: a scene of arrival reads warm, a scene of pressure reads urgent."
• "Use one of these narrative beats: setup / confrontation / resolution" → If dramaticBeat is a structural enum: keep it (carve-out 1). If it's prose guidance: "Frame this shot as the dramatic beat the section calls for."
• "Pick a framing from: close-up, medium, wide, extreme close-up" → "You are the cinematographer; choose the framing the action of this beat needs."
• Long taste taxonomies (8+ items) → strip the list, name the role, trust the vocabulary.

The diagnostic line for in-prompt restraint

Even after stripping prescriptive palettes, a prompt should explicitly grant permission for restraint, otherwise the LLM may default to maximalism (use every dimension; show every angle; cover every beat). One short clause does this work:

"Choose the [vantage / tone / framing / detail level] each moment earns. When one held [thing] is the right answer, hold it."

This is positive-framed (says what restraint looks like), non-prescriptive (doesn't list when to be restrained), and covers the "feeling obligated to cycle through every dimension" failure mode.

---

Workflow

1. Locate Prompt Strings

Identify LLM-facing prompt strings in the target file or path.

Common patterns:

• string constants named *_PROMPT, SYSTEM_PROMPT, *Instructions, *Guidance, *_TEMPLATE
• template literal arguments to generateText, generateObject, streamText, streamObject
• system: parameters in AI SDK calls
• .prompt / .system / .instruction properties on tool definitions or agent config
• description fields on tool / function-call definitions (these are prompts to the model)
• multi-line string blocks inside prompt-builder functions
• Prompt blocks framed as [ROLE], [CONTEXT], [REFERENCE], [VOCABULARY], [PALETTE] — these label-formatted blocks are common Dimension 2 sites
• shell/wrapper/envelope prompts that wrap already-authored section prompts, item prompts, clauses, tasks, beats, or source artifacts

Useful searches:

rg -nP '(?m)^[^\n]*(?:_PROMPT|SystemPrompt|systemPrompt|Instructions\s*[:=]|instruction\s*[:=]|`[^`]{200,})' <paths>
rg -nP '\[(?:VOCABULARY|PALETTE|REFERENCE|TECHNIQUES?|OPTIONS|CHOICES|TAXONOMY)\b' <paths>
rg -n "producer|shell|wrapper|envelope|adapter|sectionPrompt|committedPrompt|approvedPrompt|compiledPrompt|promptSections|source of truth|binding" <paths>

2. Detect Direction patterns (Dimension 1)

Search for canonical negative phrasings:

rg -nP "(?i)\b(do\s+not|don[']t|never|must\s+not|avoid|refrain\s+from|stop\s+\w+ing|no\s+\w+\s+(allowed|permitted))\b" <paths>

Note: bare no X and never produce many false positives. Manual review for those classes.

3. Detect Prescriptiveness patterns (Dimension 2)

Search for enumeration shapes:

rg -nP '(?i)\b(choose\s+from|pick\s+from|reach\s+for|use\s+one\s+of|select\s+from|one\s+of\s+the\s+following)\b' <paths>
rg -nP '(?im)^\s*-\s+\w+(?:[-/]\w+)?\s*[:.]' <paths>  # bulleted definitions, often palettes
rg -nP '\[(?:VOCABULARY|PALETTE|REFERENCE|TECHNIQUES?|OPTIONS|CHOICES|TAXONOMY)' <paths>

For each match, ask the diagnostic test: Does this list create pressure on the LLM to use items from it? If yes, flag.

3b. Detect Authority Boundary patterns

Search for shell prompts that add meaning after a smaller unit prompt/artifact has already been authored, committed, approved, or persisted.

Flag when:

• the wrapper carries creative, continuity, policy, business, or product direction that can diverge from the committed unit prompt
• the downstream provider/worker appears bound to shell prose instead of the committed section/item prompt or final authored artifact
• the shell instruction is compensating for missing detail in the committed unit prompt
• the test surface checks the wrapper text but not the final compiled request sent to the provider/worker/tool

4. Classify Each Match

For each match (Direction or Prescriptiveness), classify:

• Carve-out — verify — falls into one of the documented carve-outs for its dimension. Skip the reframe; surface for human verification.
• Reframe candidate (Direction) — negative phrasing that should be positive direction.
• Reframe candidate (Prescriptiveness) — enumerated palette that should be replaced by role + context.
• Reframe candidate (Both) — negative and prescriptive ("Don't choose from these"). Reframe along both axes.
• Vague taste rule — reframe alone is incomplete. Recommend reframe + add example + tighten role/schema description.
• Authority boundary finding — a shell/wrapper/envelope is carrying authority that belongs in the committed unit prompt/artifact. Recommend moving the binding instruction to that unit and keeping the shell transport-only.
• Possibly load-bearing — the original encodes a subtle constraint a simple reframe loses. Surface for human judgment with candidate suggestion.
• False positive — idiom, doc string about code, code comment.

5. Reframe and Output

For each flagged prompt fragment:

• file path : line range
• original phrasing (one short quote)
• dimension (Direction / Prescriptiveness / Both)
• classification
• proposed reframing (or "verify carve-out applies")
• rationale (one sentence)

The reframing is a suggestion, not an autofix. Human authors confirm and apply.

Output Format

## Prompt Instruction Framing Audit: <file or feature>

### Summary
- Prompt strings reviewed: N
- Direction findings (negative → positive): N
- Prescriptiveness findings (palette → directorial): N
- Both-axis findings: N
- Authority boundary findings (shell → committed unit): N
- Carve-outs (verified appropriate): N
- Vague taste rules (reframe + add examples): N
- Possibly load-bearing (human review): N
- False positives dropped: N

### Direction findings
1. <file:line>
   Original: "..."
   Reframe: "..."
   Rationale: ...

### Prescriptiveness findings
1. <file:line>
   Original: "..."
   Reframe: "..."
   Rationale: <which role + context would replace the palette>

### Both-axis findings
1. <file:line>
   Original: "..."
   Reframe: "..."
   Rationale: ...

### Authority boundary findings
1. <file:line>
   Original: "..."
   Binding source should be: <committed section prompt / item prompt / source artifact / task / clause>
   Correction: <move instruction into binding unit; keep shell to logistics/transport>
   Rationale: ...

### Vague taste rules (need positive examples or richer role)
1. <file:line>
   Original: "..."
   Suggested: <reframe + role/example/schema augmentation>

### Possibly load-bearing (human review)
1. <file:line>
   Original: "..."
   Candidate reframe: "..."
   What might be lost: ...

### Carve-outs (no change recommended)
1. <file:line> — <axis: Direction | Prescriptiveness> — <category>
   Original: "..."
   Why correct here: ...

Guardrails

• Do not autofix. The skill suggests; humans decide.
• Do not strip negation in carve-out categories without explicit human confirmation.
• Do not strip enumeration that is structurally required. Validated enums, provider-required values, and tool selection lists are contracts, not guidance smells.
• Do not assume every reframe is value-equivalent. Some original phrasings encode subtle constraints the simple reframe loses. Surface uncertainty in "Possibly load-bearing" rather than confidently rewriting.
• Do not over-fire on idioms or non-instruction text. "There is no easy answer" is not a negative instruction. "Choose your battles" is not a Dimension 2 enumeration.
• Do not propose reframes for code comments or doc strings about code.
• Test the reframe on both axes. A reframe that turns a negative into a palette has fixed Dimension 1 but introduced Dimension 2. A good reframe satisfies both: positive-framed AND directorial.
• Apply the diagnostic test for Dimension 2. "Does this create pressure to use items from a list?" is the operational guardrail. If yes, the list is a cage even when it's positively phrased.
• Do not make shells more authoritative as a prompt fix. If a committed unit prompt or source artifact exists, move binding creative/continuity/ policy/product instructions there. Shells may coordinate and transport; they should not become a hidden source of truth.

When To Stop

The goal isn't zero negative phrases or zero enumerations — it's reliable, contextual, well-judged LLM output. Some prompts will retain a small number of well-placed prohibitions or enumerations, especially in carve-out contexts. The audit is done when:

• every reframe candidate has a proposed positive, non-prescriptive equivalent
• every authority-boundary finding names the binding prompt/artifact and the shell instruction that should move or disappear
• carve-outs are documented in-place (e.g., a comment near the negation/enumeration noting it's intentional and which carve-out applies) so future reviews don't re-fire
• vague taste rules have at least one positive example, a richer role description, or a schema-description suggestion
• load-bearing items are surfaced for human judgment rather than silently rewritten
• the prompt as a whole reads like role + context + permission for restraint rather than prohibitions + palettes + checklists

Background — why this matters

Negation handling and over-prescription are both measurable, persistent LLM weaknesses:

Negation:

• Training distribution skew. Instruction-tuning datasets are heavily positive-weighted. Models have fewer learned patterns for "produce X without Y" than for "produce X."
• Computational asymmetry. Negation requires the model to compute "the target distribution after suppressing X" — strictly harder than "the target distribution given Y."
• Attention instability around negation tokens. not / do not tokens are weakly attended in some positions. Persona / warning prompts that re-direct attention to negation tokens recover 10-25% accuracy in benchmarks.
• Mention-amplification ("pink elephant"). Naming a concept to suppress it can activate the same attention pathways as naming it to produce it. The cure is to never mention the suppressed concept; the positive-reframe pattern achieves this naturally.

Over-prescription:

• Menu satisfaction. When given a closed list, the LLM optimizes for "satisfying the menu" — picking items, often cycling through several to "use the dimensions" — rather than authoring contextually.
• Vocabulary suppression. A list of N items implicitly tells the model "these are the available choices." The model's own contextual vocabulary, which would have produced richer or more specific terms, is suppressed in favor of the list.
• Maintenance debt. Every domain expansion requires editing the list. Out-of-distribution scenarios get force-fit to list items.
• Lost role activation. When the role is rich and the context is right, the LLM produces appropriate vocabulary on its own. The palette substitutes for the role rather than complementing it.

Across major providers, only Anthropic's docs explicitly document the Direction preference (and only for examples, not instructions per se). The Prescriptiveness axis is essentially uncodified — which makes per-repo audit higher-leverage than typical "best practice" reminders.

Related skills

• intent-smell-audit — broader scan covering regex / fallback / schema / duality drift smells. The "Negative prompt pressure" and "Over-controlled guidance / tiny slug menus" categories in that skill point at the same patterns; this skill is the focused workflow for the reframe along both axes.
• decisive-root-fix — when the root cause behind brittle prompt prose is wrong upstream contract (e.g., the schema permits broad prose that the consumer can't use, or the role is set at the wrong layer), pair with decisive-root-fix rather than just rewriting the prompt.