CAI (Cybersecurity AI) — Prompts
CAI uses code-class agent definitions (Python dataclasses) with string instructions fields as the primary "prompt" mechanism. The src/cai/prompts/ directory contains system prompt templates.
Agent Class as Prompt (SDK Pattern)
@dataclass
class Agent(Generic[TContext]):
"""An agent is an AI model configured with instructions, tools, guardrails, handoffs."""
name: str
"""The name of the agent."""
instructions: (
str
| Callable[
[RunContextWrapper[TContext], Agent[TContext]],
MaybeAwaitable[str],
]
| None
) = None
"""The instructions for the agent. Will be used as the 'system prompt' when this agent is
invoked. Describes what the agent should do, and how it responds."""
handoff_description: str | None = None
"""A human-readable description of the agent, used when the agent is used inside
tools/handoffs."""
tools: list[Tool[TContext]] = field(default_factory=list)
guardrails: list[InputGuardrail[TContext]] = field(default_factory=list)
output_guardrails: list[OutputGuardrail[TContext]] = field(default_factory=list)
model: str | Model | None = None
model_settings: ModelSettings = field(default_factory=ModelSettings)
Prompting technique: Structured dataclass definition where instructions is the system prompt. Dynamic instructions via callable allow per-run context injection. This is the OpenAI Agents SDK pattern — code-as-configuration.
Red Teamer Agent Instructions (Typical Pattern)
From agents.yml.example structure and red_teamer agent (representative):
red_teamer = Agent(
name="Red Teamer",
instructions="""You are an expert penetration tester. Your goal is to:
1. Enumerate attack surfaces systematically
2. Identify vulnerabilities using available tools
3. Attempt exploitation following responsible disclosure principles
4. Document findings for the reporter agent
IMPORTANT: Only test systems you are explicitly authorized to test.
Do not perform actions that could cause permanent damage.
Hand off to the reporter agent when you have confirmed findings.""",
tools=[nmap_scan, gobuster, sqlmap, ...],
handoffs=[reporter_agent, codeagent],
)
Prompting technique: Step-by-step instruction list with ethical constraints inline. The handoffs list is part of the prompt structure — the agent knows which specialists it can delegate to.
Guardrail Prompt
class DangerousCommandGuardrail(InputGuardrail):
"""Prevents execution of commands that could cause irreversible system damage."""
async def run(self, ctx, agent, input):
dangerous_patterns = ["rm -rf", "DROP TABLE", "format c:", "dd if=/dev/zero"]
if any(pattern in str(input) for pattern in dangerous_patterns):
return GuardrailFunctionOutput(
output_info="Potentially dangerous command detected",
tripwire_triggered=True
)
Prompting technique: Programmatic guardrail as safety layer — not a prompt instruction telling the LLM to be safe, but code that intercepts and blocks dangerous calls before they execute.