150+ AI Prompt Engineering Pack for Copilot, Claude & ChatGPT

Use case

Get a focused review of a diff with each issue ranked, instead of a wall of style comments.

Prompt

You are a principal engineer reviewing a pull request in a {language} codebase.
Review ONLY the diff below. Ignore formatting and naming unless it hides a bug.

{diff}

For each real issue, output one line:
<file>:<line> | <blocker|major|minor> | <what is wrong> | <concrete fix>

Then a final line: "Verdict: approve" or "Verdict: request changes" with one sentence why.
If you find nothing above minor, say so plainly.

Example input

diff --git a/src/api/users.ts b/src/api/users.ts + const rows = await db.query(`select * from users where email = '${email}'`);

Example output (illustrative)

src/api/users.ts:14 | blocker | SQL built from user input (injection) | use a parameterised query: db.query('select * from users where email = $1', [email]) Verdict: request changes. The injection must be fixed before merge.

Illustrative example (AI-generated); results vary with the model and your context.

Tips

Paste the diff, not whole files: the model focuses on what changed. Add the PR description so it can check intent against the code.

Use case

A targeted security pass over a single file: injection, auth gaps, secrets, unsafe input handling.

Prompt

Act as an application security reviewer. Audit this {language} file from a {framework} app.

{code}

Check for: injection (SQL, shell, template), missing authentication or authorisation checks, secrets in code,
unsafe deserialisation, path traversal, SSRF, weak randomness for tokens, and user input reaching sensitive sinks unvalidated.

Output a table: Line | Issue | Severity (critical/high/medium/low) | Exploit in one sentence | Fix.
Only list issues you can point to in the code. Do not list generic advice.

Example input

export async function GET(req) { const file = new URL(req.url).searchParams.get('f'); return new Response(await readFile('./uploads/' + file)); }

Example output (illustrative)

Line 3 | Path traversal | high | ?f=../../.env reads any file the server can read | resolve the path and check it stays inside ./uploads, or look files up by id

Illustrative example (AI-generated); results vary with the model and your context.

Tips

Tell it the framework: some protections (CSRF, escaping) come built in and should not be flagged. Run it per file; whole-repo pastes get shallow answers.

Use case

Find logic that belongs in the domain or service layer but lives in components or route handlers.

Prompt

You are reviewing a {framework} codebase for layering problems.

{code}

Find every place where business rules (pricing, permissions, validation, state transitions) live inside UI
components, route handlers or server actions. For each one:
- quote the lines
- name the rule in plain words
- suggest a pure function name and signature to move it into (no framework imports)
- show how the component or handler would call it

Do not suggest moving simple display formatting.

Example input

function CartTotal({ items, user }) { const total = items.reduce((s, i) => s + i.price * i.qty, 0); const discount = user.plan === 'pro' && total > 100 ? total * 0.1 : 0; return <p>{total - discount}</p>; }

Example output (illustrative)

Rule: pro users get 10% off orders over 100. Move to `cartTotal(items: Item[], plan: Plan): { total: number; discount: number }` in domain/pricing.ts; the component renders the result.

Illustrative example (AI-generated); results vary with the model and your context.

Tips

Ask for the function signatures first, then the code: it keeps the refactor small.

Use case

A REST API in Node.js with Express and TypeScript. Save as .github/copilot-instructions.md.

Prompt

# {project_name}: Express API (TypeScript)

- Layering: routes -> handlers -> services -> repositories. Handlers never touch the database.
- Validate every request body, query and params with {validation_library} at the route.
- Errors: throw AppError(code, message, status); one error middleware formats { error: { code, message } }.
- Never return stack traces or SQL errors to clients.
- All SQL is parameterised. No string-built queries.
- Every outbound HTTP call has a timeout.
- Log with the shared logger, including requestId; never log request bodies on auth routes.
- New endpoints get an integration test with {test_framework} + supertest.

Example input

Request in the editor: "Add an endpoint to update a user's email."

Example output (illustrative)

Generated code validates the body with a schema, calls usersService.updateEmail, and throws AppError('EMAIL_TAKEN', ..., 409) instead of returning a raw database error.

Illustrative example (AI-generated); results vary with the model and your context.

Tips

List your layer names exactly as the folders are named.

Use case

Projects using Prisma ORM. Save as .cursor/rules/prisma.mdc.

Prompt

---
description: Prisma query and schema conventions
globs: **/*.ts, prisma/schema.prisma
alwaysApply: false
---
- One PrismaClient instance, imported from {client_path}.
- Use select or include deliberately; never return full records with password or token fields.
- Use prisma.$transaction for multi-step writes.
- Avoid queries in loops; use findMany with where: { id: { in: ids } }.
- Schema changes go through prisma migrate dev; no db push in shared environments.
- Add @@index for fields used in where and orderBy on large tables.

Example input

Request in the editor: "Load posts with their author names."

Example output (illustrative)

Generated query uses select with author: { select: { name: true } } instead of including the whole user record.

Illustrative example (AI-generated); results vary with the model and your context.

Tips

The no-full-records rule prevents accidental password-hash leaks.

Use case

Remove the query-per-row pattern from ORM code.

Prompt

This {orm} code runs one query per item:

{code}

Show the fixed version that loads everything in a constant number of queries (eager loading, a join, or an
IN query with a lookup map). Then tell me how to confirm the fix by counting queries in a test or the logs.

Example input

posts = Post.all(); for p in posts: print(p.author.name)

Example output (illustrative)

posts = Post.objects.select_related('author'). Confirm with assertNumQueries(1) in a test.

Illustrative example (AI-generated); results vary with the model and your context.

Tips

Turn on query logging in development; N+1 problems are obvious there.

Use case

Upgrade the database engine with a tested plan and a way back.

Prompt

Plan an upgrade of {database} from version {from_version} to {to_version} on {hosting}.

Cover: breaking changes to check (tell me where to read the official release notes, do not list from memory as
fact), extension compatibility, testing on a restored copy with the app's test suite, the upgrade method
(in place, logical replication or dump/restore) with expected downtime, a rollback plan, and post-upgrade
checks (statistics, slow queries, error logs).

Example input

Postgres 13 to 16 on a managed service, 120 GB.

Example output (illustrative)

Restore last night's snapshot to a test instance, upgrade it, run the test suite and the top 20 queries, and compare timings. Production: use the provider's in-place upgrade in a maintenance window, after a manual snapshot (the snapshot is the rollback).

Illustrative example (AI-generated); results vary with the model and your context.

Tips

Always rehearse on a restored copy and time it; the rehearsal tells you the real downtime.

Use case

Restructure an opinion or overview post into a step-by-step tutorial.

Prompt

You are a technical editor. Turn this blog post into a tutorial outline for {audience}:

{post}

Output: title, what the reader builds, prerequisites, 5-9 numbered steps (each with the goal, the code or
command to show, and how to check it worked), common errors, and next steps.
Rules: plain words, short sentences, no hype words (revolutionary, game-changing, unlock, supercharge).
Do not invent numbers, benchmarks, customer names or quotes; mark anything that needs a real figure as [ADD DATA].
Keep code and commands exactly as given.

Example input

A post about why you moved background jobs from cron to a queue.

Example output (illustrative)

Title: Move cron jobs to a queue in Node.js. Step 1: list current cron jobs and their schedules (check: a table of jobs). Step 2: add the queue library ...

Illustrative example (AI-generated); results vary with the model and your context.

Tips

Give the audience level; a tutorial for juniors needs more steps.