# LLM Prompt Engineering Guide
## Production Techniques for Claude, GPT-4, Gemini, and Local Models
*GeniusTechLab — 2026 Edition*
---
## Table of Contents
1. [Foundamentals: How LLMs Process Prompts](#1-fundamentals)
2. [System Prompt Design](#2-system-prompt-design)
3. [Zero-Shot, Few-Shot, and Chain-of-Thought](#3-prompting-strategies)
4. [Structured Output Patterns](#4-structured-output)
5. [RAG Prompt Engineering](#5-rag-prompts)
6. [Chain-of-Thought and Reasoning](#6-cot-reasoning)
7. [Prompt Chaining and Pipelines](#7-prompt-chaining)
8. [Evaluation and Testing](#8-evaluation)
9. [30+ Real-World Prompt Templates](#9-templates)
10. [Model-Specific Optimization](#10-model-specific)
11. [Common Pitfalls and Anti-Patterns](#11-pitfalls)
---
## 1. Fundamentals {#1-fundamentals}
### Token Economics
Every prompt is tokenized before processing. Understanding token boundaries helps you write more efficient prompts:
- **1 token ≈ 4 characters** in English (varies by language)
- **Key tokens:** " AI", " security", " homelab" — leading space matters
- **Cost optimization:** Trim redundant context, use abbreviations in system prompts
- **Context window management:** Reserve 20-30% of context for output
### The Prompt Stack
```
[System Prompt] → Sets behavior, persona, constraints
[User Message] → The actual task/query
[Context/RAG] → Retrieved documents, prior conversation
[Examples] → Few-shot demonstrations
[Output Format] → Structure specification
```
### Temperature and Sampling
| Temperature | Use Case | Example |
|------------|----------|---------|
| 0.0 | Code generation, data extraction, classification | "Extract all IP addresses from this log" |
| 0.3 | Summarization, translation, rewriting | "Summarize this security advisory" |
| 0.7 | Creative writing, brainstorming, ideation | "Generate 5 blog post titles about..." |
| 1.0+ | Creative fiction, divergent thinking | "Write a sci-fi story about..." |
---
## 2. System Prompt Design {#2-system-prompt-design}
### Anatomy of a Production System Prompt
```
You are [ROLE] with [EXPERTISE].
Your primary objective: [GOAL]
Constraints:
- [CONSTRAINT 1]
- [CONSTRAINT 2]
- [CONSTRAINT 3]
Output format: [FORMAT SPEC]
Tone: [TONE DESCRIPTION]
When you don't know: [FALLBACK BEHAVIOR]
```
### Production System Prompt Template
```markdown
You are a senior security analyst specializing in AI/ML infrastructure
security. You have 15+ years of experience in penetration testing,
threat modeling, and incident response.
Your objective: Analyze security findings and provide actionable
remediation guidance.
Constraints:
- Never speculate about vulnerabilities you cannot confirm
- Always cite the specific evidence from the provided context
- Prioritize findings by CVSS score and business impact
- Use MITRE ATT&CK technique IDs where applicable
Output format: Markdown with the following sections:
## Summary
## Findings (table: ID | Severity | Description | Remediation)
## Recommendations (prioritized list)
## References
Tone: Professional, direct, technical. No hedging language.
When you don't know: State "Insufficient data to assess" and explain
what information would be needed.
```
### Anti-Pattern: Vague System Prompts
❌ **Bad:** "You are a helpful assistant."
✅ **Good:** "You are a technical writer specializing in homelab
infrastructure guides. You explain complex networking concepts using
practical analogies and real hardware examples. You always include
cost estimates and power consumption figures."
---
## 3. Prompting Strategies {#3-prompting-strategies}
### Zero-Shot
Use when the task is simple and the model likely has relevant training data:
```
Classify this email as 'phishing', 'spam', or 'legitimate':
[email content]
```
### Few-Shot
Provide 2-5 examples to establish the pattern:
```
Classify the security finding:
Example 1:
Finding: "SQL injection in login form parameter 'username'"
Classification: Critical
Reason: Direct database access via user input
Example 2:
Finding: "Missing HSTS header on web server"
Classification: Low
Reason: Defense in depth, not directly exploitable
Now classify:
Finding: "[YOUR FINDING HERE]"
```
### Best Practices for Few-Shot
- Use **3-5 examples** (more doesn't help, less is inconsistent)
- Ensure examples are **diverse** (cover edge cases)
- Keep examples **consistent in format**
- Place examples **before** the actual task
- Use **balanced classes** (don't show 4 critical and 1 low)
### Chain-of-Thought (CoT)
Trigger reasoning before the answer:
```
Analyze this network topology for security issues. Think step by step:
1. First, identify all entry points
2. Then, evaluate each entry point's exposure
3. Next, check for lateral movement paths
4. Finally, summarize the highest-risk paths
[NETWORK TOPOLOGY DESCRIPTION]
```
### CoT with Explicit Steps
```
For each of the following security recommendations, reason through:
1. What threat does this mitigate?
2. What is the implementation cost (low/medium/high)?
3. What is the risk if not implemented?
4. What is the priority (P0/P1/P2)?
Provide your reasoning, then a summary table.
```
---
## 4. Structured Output Patterns {#4-structured-output}
### JSON Output
```
Extract the vulnerability details and output as JSON with this schema:
{
"vulnerability": {
"name": string,
"cve_id": string | null,
"cvss_score": number,
"severity": "critical" | "high" | "medium" | "low",
"affected_components": string[],
"remediation": string,
"references": string[]
}
}
Vulnerability description: [TEXT]
```
### XML-Style Structuring (for Claude)
```
Extract the key findings from this security report.
high
[component name]
[what was found]
[how to fix]
...
Report: [TEXT]
```
### Markdown Tables
```
Create a comparison table of the following NAS devices.
Include columns: Model | Bay Count | Max Capacity | RAM | Price | Best For
NAS devices: [LIST]
```
### Constrained Output with Regex
For APIs that support structured output:
```python
response_format = {
"type": "regex",
"pattern": r"^(Critical|High|Medium|Low): .+$"
}
```
---
## 5. RAG Prompt Engineering {#5-rag-prompts}
### Basic RAG Template
```
Answer the question based only on the provided context. If the
context doesn't contain the answer, say "I don't have enough
information to answer this."
Context:
---
[RETRIEVED CHUNK 1]
---
[RETRIEVED CHUNK 2]
---
[RETRIEVED CHUNK 3]
---
Question: [USER QUESTION]
Answer:
```
### Advanced RAG with Citations
```
You are a technical documentation assistant. Answer using ONLY the
provided context. For every claim, cite the source chunk number.
Context chunks:
[1] [SOURCE TEXT 1]
[2] [SOURCE TEXT 2]
[3] [SOURCE TEXT 3]
Question: [USER QUESTION]
Format your answer as:
- Direct answer first
- Supporting details with citations like [1], [2]
- If multiple sources conflict, note the discrepancy
- If the answer is not in the context, say so explicitly
```
### RAG with Follow-Up Generation
```
Given the conversation history and retrieved context, do two things:
1. Answer the user's question using the context
2. Generate 2 follow-up questions the user might ask
Context: [RETRIEVED DOCS]
Conversation: [HISTORY]
Current question: [QUESTION]
```
### Multi-Hop RAG
```
Step 1: Given the question, identify what information is needed.
Step 2: For each piece of information, find it in the context.
Step 3: Combine the findings to answer the question.
Question: "Which firewall in the guide supports VLAN segmentation
and costs under $500?"
Context: [RETRIEVED DOCS]
```
---
## 6. Chain-of-Thought and Reasoning {#6-cot-reasoning}
### Self-Consistency
Run the same CoT prompt 3-5 times and take the majority answer:
```python
responses = []
for _ in range(5):
resp = llm.generate(cot_prompt, temperature=0.7)
responses.append(extract_answer(resp))
final = majority_vote(responses)
```
### Tree of Thoughts
```
Explore 3 different approaches to solving this problem:
Approach A: [first strategy]
- Pros: ...
- Cons: ...
- Expected outcome: ...
Approach B: [second strategy]
- Pros: ...
- Cons: ...
- Expected outcome: ...
Approach C: [third strategy]
- Pros: ...
- Cons: ...
- Expected outcome: ...
Now evaluate which approach is best and explain why.
```
### Reflection / Self-Critique
```
First, provide your answer to the question.
Then, critically review your answer:
1. Are there any factual errors?
2. Are there any logical gaps?
3. Is anything missing?
Then, provide a revised answer addressing any issues found.
Question: [QUESTION]
```
---
## 7. Prompt Chaining and Pipelines {#7-prompt-chaining}
### Extraction → Analysis → Report
```
# Step 1: Extract
Given this log file, extract all error entries with timestamps.
Output as JSON array.
# Step 2: Analyze (using Step 1 output)
Given these error entries, identify patterns:
- Recurring errors (same message > 3 times)
- Error clusters (multiple errors within 60 seconds)
- Severity classification
# Step 3: Report (using Step 2 output)
Generate a markdown incident report with:
- Executive summary
- Timeline of events
- Root cause analysis
- Recommendations
```
### Code Generation Pipeline
```
# Step 1: Generate
Write a Python function that [TASK].
# Step 2: Review
Review this code for:
- Security vulnerabilities
- Performance issues
- Error handling gaps
- Edge cases
# Step 3: Fix
Fix all issues identified in the review.
Output only the final corrected code.
```
### Agent Loop Pattern
```
Thought: I need to [reasoning about what to do]
Action: [tool/function to call]
Observation: [result of the action]
Thought: Based on the observation, I should [next reasoning]
Action: [next action]
...
Final Answer: [conclusion]
```
---
## 8. Evaluation and Testing {#8-evaluation}
### Building an Eval Set
```python
eval_cases = [
{
"input": "Is port 22 open on 192.168.1.1?",
"expected_intent": "port_scan",
"expected_entities": {"port": 22, "host": "192.168.1.1"}
},
{
"input": "What CVEs affect Apache 2.4.57?",
"expected_intent": "cve_lookup",
"expected_entities": {"software": "Apache", "version": "2.4.57"}
}
]
```
### LLM-as-Judge Prompt
```
You are evaluating an AI assistant's response. Score it on:
1. **Accuracy** (1-5): Is the information correct?
2. **Completeness** (1-5): Does it address all parts of the question?
3. **Clarity** (1-5): Is it easy to understand?
4. **Actionability** (1-5): Can the user act on this information?
Question: [QUESTION]
Response: [RESPONSE]
Reference answer: [CORRECT ANSWER]
Provide scores and brief justification for each.
```
### A/B Testing Prompts
```python
results = {"prompt_a": [], "prompt_b": []}
for case in eval_cases:
resp_a = llm.generate(prompt_a.format(**case))
resp_b = llm.generate(prompt_b.format(**case))
results["prompt_a"].append(score(resp_a, case["expected"]))
results["prompt_b"].append(score(resp_b, case["expected"]))
print(f"Prompt A avg: {mean(results['prompt_a'])}")
print(f"Prompt B avg: {mean(results['prompt_b'])}")
```
---
## 9. 30+ Real-World Prompt Templates {#9-templates}
### Security Analysis
**1. Vulnerability Triage**
```
Given this vulnerability scan result, triage each finding:
- Drop false positives (explain why)
- Assign priority (P0-P3) based on exploitability + impact
- Group related findings
Output as a markdown table with: Finding | Verdict | Priority | Action
```
**2. Log Analysis**
```
Analyze this authentication log for suspicious activity:
- Failed login bursts (>5 in 60s)
- Logins from new geographic locations
- Off-hours access (outside 7am-7pm)
- Privilege escalation events
Output: timeline of suspicious events + risk score (1-10)
```
**3. Threat Intelligence Summary**
```
Summarize this threat intel feed for a non-technical executive audience:
- Top 3 threats in plain English
- Business impact for a [INDUSTRY] company
- One action they should take this week
Keep under 200 words.
```
### Code & Development
**4. Code Review**
```
Review this code as a senior engineer. Focus on:
1. Security (injection, auth bypass, data exposure)
2. Performance (N+1 queries, unnecessary allocations)
3. Maintainability (naming, complexity, missing tests)
Be specific — cite line numbers and suggest fixes.
```
**5. Test Generation**
```
Generate unit tests for this function covering:
- Happy path (2 cases)
- Edge cases (empty input, max values, null)
- Error cases (invalid input, network failure)
- Boundary conditions
Use pytest. Include docstrings explaining each test's purpose.
```
**6. Refactoring**
```
Refactor this code to improve readability without changing behavior:
- Extract functions for complex blocks
- Use descriptive variable names
- Add type hints
- Simplify conditional logic
Show the before/after diff.
```
### Content & Documentation
**7. Technical Blog Post**
```
Write a technical blog post about [TOPIC] for an audience of
[PERSONA]. Include:
- A compelling introduction (why this matters now)
- 3-5 main sections with code examples
- A practical "how to implement" section
- Common pitfalls section
- Summary with next steps
Target: 1500-2000 words. Tone: authoritative but accessible.
```
**8. Documentation Generator**
```
Given this code, generate:
1. A module-level docstring explaining the purpose
2. Function docstrings (args, returns, raises, examples)
3. A usage example showing common patterns
4. An API reference table
Format as Markdown.
```
### Data & Analysis
**9. Data Extraction**
```
Extract the following from this unstructured text:
- All dates (normalize to ISO 8601)
- All monetary amounts (normalize to AUD)
- All product names and versions
- All company names
Output as JSON. Use null for missing fields.
```
**10. Comparison Table**
```
Compare these [ITEMS] across the following dimensions:
[DIMENSION 1], [DIMENSION 2], [DIMENSION 3], ...
Output as a markdown table with:
- A winner for each dimension
- A summary recommendation based on different user needs
- Cost analysis
```
### Homelab & Infrastructure
**11. Network Design**
```
Design a network topology for a homelab with these requirements:
- [REQUIREMENT 1]
- [REQUIREMENT 2]
Provide:
1. ASCII network diagram
2. VLAN assignment table
3. Firewall rules (allow/deny matrix)
4. IP address allocation plan
5. Equipment list with approximate costs
```
**12. Proxmox Planning**
```
Given this hardware (CPU, RAM, storage, GPU), recommend a Proxmox
configuration:
- VM vs LXC for each workload
- Resource allocation (CPU, RAM, disk per guest)
- Storage strategy (ZFS pool layout)
- Network configuration
- Backup strategy
Include a summary table.
```
### AI/ML Operations
**13. Model Evaluation Plan**
```
Design an evaluation plan for [MODEL TYPE] on [TASK]:
1. Define metrics (accuracy, latency, cost)
2. Create test data splits
3. Define pass/fail thresholds
4. Describe the eval pipeline
5. List potential failure modes
Output as a structured markdown document.
```
**14. RAG System Design**
```
Design a RAG system for [USE CASE]:
1. Document chunking strategy
2. Embedding model recommendation
3. Vector database choice
4. Retrieval strategy (hybrid, reranking)
5. Prompt template for generation
6. Eval approach
Include cost estimates for 10K queries/month.
```
### Business & Operations
**15. Incident Response Plan**
```
Create an incident response plan for [SCENARIO]:
1. Detection triggers
2. Severity classification
3. Response team roles
4. Containment steps
5. Eradication steps
6. Recovery steps
7. Post-incident review template
Format as a runbook with clear action items.
```
**16. Vendor Assessment**
```
Evaluate [VENDOR] for [USE CASE] based on:
- Security posture (certifications, incidents)
- Pricing model
- Support quality
- Integration complexity
- Exit strategy (data portability)
Output: recommendation (adopt/trial/reject) with justification.
```
### Creative & Brainstorming
**17. Product Ideas**
```
Generate 10 product ideas for [MARKET] that:
- Solve a real pain point
- Can be built in under 3 months
- Have a clear monetization path
- Leverage AI but aren't just "ChatGPT wrappers"
For each: name, problem, solution, target user, pricing, unique angle.
```
**18. Architecture Alternatives**
```
Propose 3 different architectures for [SYSTEM]:
- Conservative (proven, stable)
- Balanced (modern, pragmatic)
- Ambitious (cutting-edge, high reward)
For each: diagram, tech stack, trade-offs, estimated cost, timeline.
```
### Debugging
**19. Error Diagnosis**
```
Given this error and stack trace:
[ERROR + STACKTRACE]
1. What is the root cause?
2. What are 3 possible fixes (from quickest to most robust)?
3. How to prevent this in the future?
4. Is this a known issue? (check for common patterns)
```
**20. Performance Debugging**
```
This operation takes [X seconds]. Expected: [Y seconds].
Profile output: [PROFILE DATA]
1. Where is the bottleneck?
2. What are the top 3 optimizations?
3. What's the expected improvement for each?
4. Which should be done first (ROI analysis)?
```
### Additional Templates (21-30)
**21. Email Triage** — Classify and draft responses
**22. Meeting Notes** — Extract action items and decisions
**23. RFP Response** — Generate first draft from requirements
**24. Competitive Analysis** — Feature comparison matrix
**25. User Story Generation** — From feature requests
**26. SQL Query Builder** — Natural language to SQL
**27. Regex Generator** — Describe pattern, get regex
**28. API Documentation** — From OpenAPI spec
**29. Security Policy Draft** — From compliance requirements
**30. Training Plan** — Personalized learning path from goals
---
## 10. Model-Specific Optimization {#10-model-specific}
### Claude (Anthropic)
- Use **XML tags** for structure: ``, ``, `