Security Expert
“You are an expert security engineer. Review this code for XSS, CSRF, and SQL injection. List every issue with a concrete fix.”
You ask for “a user authentication system with email verification,” the model picks a session strategy you’d never ship, hardcodes a mailer you don’t use, and you spend the next twenty minutes un-picking choices it made because you never made them. The model wasn’t wrong — it was unguided. The gap between a frustrating session and a great one is almost never the model. It’s how you frame the request.
These are the prompting patterns that consistently produce accurate, well-architected code across Cursor, Claude Code, and Codex.
This works because it forces the model to expose its assumptions while they’re still cheap to change. Use the same pattern across the lifecycle:
The more constraints you supply, the less the model improvises. Vague requests get generic code; specific requests get code you can ship.
pg library. Load the connection string from DATABASE_URL. Include retry logic with exponential backoff and a typed health-check function.”Naming the library, the env var, and the error behavior upfront steers the model to the right implementation in one pass instead of three.
For anything bigger than a one-line change, force the model to think before it codes.
Ask for a plan first — and forbid code.
I need a feature that lets users upload a profile picture. First,produce a detailed, step-by-step plan: list the files you'll createor modify and the order of changes. Do NOT write any code yet.Review and refine the plan. The model returns an outline (“1. Add /api/upload-avatar. 2. Add a file input to ProfilePage…”). Correct it before any code exists: “Use a separate AvatarUpload component instead of editing ProfilePage directly.”
Execute the approved plan.
The plan looks good. Implement step 1 only, then stop so I can reviewthe diff before we continue.This two-phase loop catches architectural mistakes when they cost a sentence to fix, not a 30-file diff. For the full discipline, see PRD to Plan to Todo.
To make the model match your codebase’s conventions, show it an existing file rather than describing the convention in prose.
PaymentService class that follows the exact pattern and structure of @/services/AuthService.ts.”Models are excellent at pattern-matching. A concrete example is a tighter spec than any description.
Priming the model with a role focuses it on the right domain of knowledge.
Security Expert
“You are an expert security engineer. Review this code for XSS, CSRF, and SQL injection. List every issue with a concrete fix.”
Performance Guru
“You are a senior performance engineer. Find bottlenecks in this function and suggest optimizations that reduce allocations and time complexity.”
Treat the session as a dialogue, not a single shot. Steer the first attempt toward what you actually want:
ifs into a switch.”When output quality drops, the cause is almost always context or configuration — not the model. The fixes differ per tool, so this is where the three diverge most.
@-mention the source — @auth.ts extend the login logic — so it edits rather than reinvents./init to generate a CLAUDE.md, then refine it as the project evolves./context before a big task; /clear between unrelated tasks and /compact <instructions> to trim noise mid-thread./model or CLAUDE_CODE_EFFORT_LEVEL: low / medium / high) — not by typing “ultrathink”, which is now treated as a plain instruction and allocates no extra thinking./init inside the TUI to scaffold an AGENTS.md, and keep per-package AGENTS.md files for monorepos.--ask-for-approval (untrusted / on-failure / on-request / never) and pick the right model — GPT-5.5 powers Codex by default across surfaces; use gpt-5.2-codex for API-key-authenticated workflows.Set up context. Maintain project rules / CLAUDE.md / AGENTS.md; refresh as the codebase changes.
Use the right capability. Pick a top model; on Claude Code raise the effort level for architecture work; in Cursor enable MAX mode for large context.
Be explicit. Reference specific files with @-mentions and show example patterns.
Request clarification. End prompts asking what the model needs; use the PRD to Plan to Todo loop for control.
Configure documentation access. Add the Context7 MCP, or instruct a web search for current library docs.