GLM-5.3 Prompt Generator

You are a senior software architect agent. Analyse the provided Python codebase (approximately 80,000 lines across 12 microservices) and deliver a complete refactoring roadmap: 1. ARCHITECTURE AUDIT — identify all anti-patterns: God classes, circular dependencies, tight coupling, missing abstractions, and duplicated business logic 2. DEPENDENCY MAP — produce an ASCII diagram of service dependencies, flagging any bidirectional dependencies or cycles 3. DEAD CODE — list files and functions with zero call sites (be precise — reference exact filenames and line numbers) 4. REFACTORING PLAN — prioritised list of 10 changes ranked by impact vs effort, with 2-sentence rationale for each 5. MIGRATION STRATEGY — for the top-3 changes, write a step-by-step migration path that keeps the service live throughout 6. TEST COVERAGE GAPS — identify the 5 highest-risk untested code paths and write one test case for each [Paste codebase or provide repository access]

Conduct a structured threat model for the following production system using the STRIDE framework: System: A SaaS platform with a React frontend, Node.js API layer, PostgreSQL database, Redis cache, and S3 file storage. Users authenticate via OAuth2 (Google, GitHub). The API is public. Admins access a separate internal dashboard behind VPN. For each STRIDE category (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege): 1. Identify at least 2 concrete threat scenarios specific to this architecture 2. Rate each threat: Likelihood (High/Medium/Low) × Impact (High/Medium/Low) 3. Propose a specific technical mitigation with an implementation note Finish with a prioritised risk register — top 10 threats ranked by combined risk score, with the single most important mitigation for each. Be specific to this architecture, not generic.

You are a data engineering agent. Build a complete end-to-end data pipeline: Requirement: Ingest clickstream data from 50 million daily events (JSON over Kafka), clean and deduplicate, compute 12 business metrics (DAU, retention cohorts, funnel conversion, feature adoption rates), and write aggregated results to a data warehouse (BigQuery) for Looker dashboards. Deliver: 1. ARCHITECTURE — draw the full pipeline in ASCII with every component, data store, and handoff point 2. KAFKA CONSUMER — Python consumer with error handling, dead-letter queue, and backpressure 3. TRANSFORMATION LAYER — Apache Beam job that deduplicates, parses, and validates events 4. METRIC DEFINITIONS — SQL for all 12 metrics with exact query logic (no pseudocode) 5. BIGQUERY SCHEMA — DDL for all destination tables with partitioning and clustering keys 6. MONITORING PLAN — the 5 SLOs you would set, with alert thresholds and on-call runbook for each 7. COST ESTIMATE — rough monthly cloud cost breakdown assuming BigQuery on-demand pricing Think through failure modes at each stage before writing any code.

Complete the following multi-step terminal task autonomously. Think through each step before running commands. If a command fails, diagnose and retry. Task: On an Ubuntu 22.04 server: 1. Install and configure Nginx as a reverse proxy for a Node.js app running on port 3000 2. Obtain a Let's Encrypt TLS certificate for api.example.com using Certbot 3. Configure automatic certificate renewal via cron 4. Set up rate limiting (100 req/min per IP) and block requests from the top-10 Tor exit nodes (fetch the current list) 5. Configure Nginx access log format to include request latency and upstream response time 6. Write a bash health-check script that alerts via curl webhook if the upstream app returns non-200 for 3 consecutive checks 7. Verify the full setup works end-to-end Output every command you would run, the expected output, and what you'd do if the step fails.

I'm providing the complete EU AI Act (approximately 400 pages) plus our company's AI product specification (80 pages). Conduct a full compliance gap analysis: 1. SCOPE CHECK — does our product fall under High-Risk AI System classification? Walk through Article 6 with our spec as input 2. REQUIREMENT EXTRACTION — list every mandatory obligation under Articles 9–15 that applies to a High-Risk system, with exact article citations 3. GAP MATRIX — for each obligation, assess our current state: Compliant / Partial / Non-Compliant / Not Assessed, with evidence from our spec 4. CRITICAL GAPS — the 5 gaps that would prevent market entry, with the fastest path to compliance for each 5. DOCUMENTATION REQUIREMENTS — the exact technical documentation we must prepare under Annex IV 6. RISK MANAGEMENT PLAN — a draft risk management system outline per Article 9 requirements Be precise — cite exact articles, not paraphrases. Flag any ambiguity where interpretation is required. [Paste both documents]

Conduct a security audit of the following Node.js/Express API codebase. Identify every vulnerability with precision: For each finding: - VULNERABILITY TYPE (OWASP Top 10 category or CWE identifier) - EXACT LOCATION (file, function name, line number) - PROOF OF CONCEPT — the exact payload or request that would exploit it - SEVERITY (Critical / High / Medium / Low) with CVSS score estimate - FIX — the exact code change needed, not just advice Priority areas to audit: 1. Authentication and session management 2. Input validation and SQL injection surfaces 3. Insecure direct object references (IDOR) 4. Rate limiting and brute-force protection 5. Secrets in code or environment variable handling 6. Dependency vulnerabilities (check package.json) 7. Server-side request forgery (SSRF) risk in any HTTP calls Sort findings by CVSS score descending. Include a remediation roadmap with estimated hours to fix each issue. [Paste codebase]

You are a full-stack engineer agent. Build a complete multi-tenant subscription billing system from scratch. Work through this phase by phase, completing each phase fully before moving to the next. Phase 1 — Data model: PostgreSQL schema for tenants, subscriptions, plans, invoices, payment_methods. Include all constraints, indexes, and audit fields. Phase 2 — Stripe integration: webhook handler for all relevant events (checkout.session.completed, invoice.paid, invoice.payment_failed, customer.subscription.deleted). Include idempotency key handling. Phase 3 — API layer: REST endpoints for: create/upgrade/downgrade/cancel subscription, get billing history, update payment method, handle trial-to-paid conversion. Phase 4 — Frontend: React billing settings page — current plan, usage, invoice history, payment method management, upgrade/downgrade modal. Phase 5 — Testing: integration tests covering the 5 most critical billing scenarios including failed payment retry logic. Do not stop between phases. Complete the full implementation.

I'm providing a complete monorepo (approximately 200,000 lines of TypeScript across 25 packages). There is a production bug: Bug report: When users in timezones west of UTC submit a form after 11 PM local time, their submission is recorded with yesterday's date in the database, causing it to miss daily reporting queries. Using the full codebase: 1. TRACE — identify every function in the call chain from form submission to database write, with file paths and line numbers 2. LOCATE — find the exact line(s) where timezone handling fails 3. ROOT CAUSE — explain the bug precisely: what assumption in the code is wrong? 4. FIX — provide the exact code change, showing the old and new version 5. REGRESSION TEST — write a unit test that fails before the fix and passes after 6. AUDIT — search the entire codebase for the same pattern in other date-handling code and list any other at-risk locations [Paste the monorepo or provide a file tree + relevant excerpts]

Write a complete incident response plan for the following ransomware scenario: Scenario: At 02:47 UTC, your monitoring system alerts: 60% of files on 3 production servers have had their extensions changed to .enc. The backup system shows the last clean backup was 18 hours ago. Customer data is on-premises (GDPR scope). The affected servers run PostgreSQL and serve your main SaaS application. Plan must cover: 1. IMMEDIATE ACTIONS (0–15 minutes): exact commands to isolate affected systems without destroying forensic evidence 2. CONTAINMENT (15–60 minutes): network isolation, credential rotation, identify patient zero 3. ASSESSMENT (1–4 hours): blast radius analysis, determine if exfiltration occurred, preserve evidence for forensics 4. COMMUNICATION (parallel): internal escalation chain, customer notification timeline, regulatory notification requirements under GDPR Article 33 (72-hour window) 5. RECOVERY: restore sequence, integrity verification, re-onboarding customers 6. POST-INCIDENT: root cause analysis format, the 5 controls that would have prevented or detected this earlier Include actual commands at every step where commands are appropriate.

Design a distributed rate limiter that: - Handles 5 million requests per second across 100 API servers - Supports per-user, per-tenant, and per-endpoint limits independently - Allows burst allowances (token bucket) with configurable refill rates - Persists rate limit state across server restarts - Adds ≤2ms latency at P99 - Handles partial Redis failures without dropping all traffic Deliver: 1. ALGORITHM CHOICE — compare token bucket vs sliding window vs fixed window for this use case, with concrete trade-offs 2. DATA STRUCTURE — exact Redis data structure(s), key schema, and Lua script for atomic check-and-decrement 3. DISTRIBUTED CONSISTENCY — how do you handle the race condition when two servers check the same bucket simultaneously? 4. FAILURE MODES — what happens when Redis is unavailable? Give code for the fallback strategy 5. IMPLEMENTATION — complete Python implementation with async Redis client 6. BENCHMARKING — how you would load-test this to prove the <2ms P99 requirement is met No hand-waving — every claim needs a concrete implementation or proof.

I'm providing 12 documents totalling approximately 800 pages: the acquisition target's last 3 years of audited financials, board minutes, customer contracts (anonymised), employment agreements, IP assignment records, and pending litigation files. Conduct a full M&A due diligence analysis: 1. FINANCIAL HEALTH — revenue quality (recurring vs one-time), gross margin trends, burn rate, working capital position, any off-balance-sheet obligations 2. CUSTOMER CONCENTRATION — identify the top 10 customers by revenue, their contract terms, renewal dates, and any auto-renewal or termination clauses 3. LEGAL RISKS — open litigation, pending IP disputes, employment claims, regulatory investigations — assess likelihood and maximum exposure for each 4. IP OWNERSHIP — confirm IP assignment from all founders and employees, identify any gaps or competing claims 5. KEY-PERSON RISK — which people are business-critical, do they have non-competes, and are any within 6 months of vesting cliff? 6. RED FLAGS — the 5 issues that would cause you to recommend against the acquisition or require price adjustment 7. NEGOTIATION LEVERS — based on the findings, the top 3 representations and warranties you would insist on [Paste all 12 documents]

You are a code review agent. Review the provided pull request diff (approximately 3,000 lines changed across 40 files) and produce a structured review: 1. SUMMARY — 3-sentence description of what this PR does and its architectural impact 2. CORRECTNESS ISSUES — bugs, logic errors, edge cases that would cause incorrect behaviour in production. For each: exact file/line, the bug, a minimal reproduction case, and the fix 3. SECURITY ISSUES — any new attack surfaces, insecure patterns, or missing validation. Same format as above 4. PERFORMANCE — any N+1 queries, missing indexes, synchronous calls that should be async, or unbounded loops 5. MAINTAINABILITY — over-engineered solutions, missing tests for critical paths, unclear variable names, or missing error handling for expected failure modes 6. POSITIVE NOTES — 2–3 things done well (specific, not generic praise) 7. REQUIRED vs NICE-TO-HAVE — split your findings: which must be fixed before merge, which are optional improvements Format each finding as: [SEVERITY] File: path/to/file.ts:line — Description — Fix. [Paste PR diff]

You have completed an authorised black-box penetration test of a web application (provided: scope agreement, test evidence, screenshots, and request/response logs). Write a professional penetration test report: Report structure: 1. EXECUTIVE SUMMARY (1 page) — written for a non-technical C-suite reader. Risk level, 3 headline findings, business impact in plain language 2. SCOPE AND METHODOLOGY — what was tested, what tools were used, what was explicitly out of scope 3. FINDINGS — for each vulnerability: - Finding ID (e.g. VUL-001) - Title and OWASP category - CVSS 3.1 score and vector - Description - Evidence (sanitised screenshots or request/response) - Business impact - Remediation (specific, not generic) - References (CVE, OWASP link) 4. RISK MATRIX — visual 5×5 grid with all findings plotted 5. REMEDIATION ROADMAP — 30/60/90 day plan prioritising critical and high findings 6. ATTESTATION — standard pen test attestation language [Paste test evidence and notes]

You are a backend engineer agent. Migrate the following REST API from v1 to v2 with zero downtime. The v1 API has 45 endpoints, 180,000 requests per day, and must remain live throughout the migration. Work through this fully: 1. AUDIT — categorise all 45 endpoints: breaking change vs additive change vs no change 2. VERSIONING STRATEGY — justify your choice between URL versioning (/v1/ vs /v2/), header versioning, or content negotiation for this case 3. BREAKING CHANGES — for each breaking endpoint: the v1 contract, the v2 contract, and the migration path for existing consumers 4. ROUTING LAYER — implement the version routing middleware in Express (route /v1/ to legacy handlers, /v2/ to new handlers, handle the deprecation header on /v1/ responses) 5. CONSUMER COMMUNICATION — draft the API deprecation notice (changelog entry + email to developers) 6. CUTOVER PLAN — the exact sequence of steps to disable /v1/ endpoints 90 days after launch, with a circuit breaker if traffic is still arriving 7. TEST PLAN — contract tests ensuring v1 and v2 behave identically for non-breaking endpoints [Paste API spec and current handler code]

Analyse the following Python web application for performance bottlenecks and optimise it for 10× throughput under load: Context: The app serves 50,000 requests/day currently but needs to handle 500,000/day within 3 months. It uses Flask, SQLAlchemy, PostgreSQL, and Redis. P95 response time is 2.1 seconds — target is 200ms. For each bottleneck you identify: 1. MEASUREMENT — how you confirmed it is a bottleneck (profiler output, query explain plan, etc.) 2. ROOT CAUSE — the exact technical reason for the slowness 3. FIX — the code change, config change, or architectural change needed 4. EXPECTED IMPACT — estimated improvement in P95 latency or throughput Specific areas to audit: - Database query patterns (N+1, missing indexes, over-fetching) - SQLAlchemy session lifecycle and connection pool configuration - Synchronous I/O that could be async - Missing or misconfigured caching - Python GIL limitations and process vs thread configuration - Serialisation overhead [Paste the codebase and current profiler output if available]

Conduct a supply chain security review for a Node.js application with 847 direct and transitive dependencies. 1. DEPENDENCY AUDIT — analyse the provided package-lock.json: - Identify any packages with zero downloads in the last 30 days (potential abandonment) - Flag packages with a single maintainer and no 2FA requirement - List any packages with known CVEs (use the provided npm audit output) - Identify any packages that were recently transferred to a new owner 2. SBOM — generate a Software Bill of Materials in SPDX format for all direct dependencies 3. RISK MATRIX — for each critical or high CVE: package name, CVE ID, CVSS score, attack vector (network/local), whether a fix version exists, and effort to update 4. POLICY RECOMMENDATIONS — based on your findings, write 5 dependency management policies this team should adopt 5. MONITORING SETUP — the exact GitHub Actions workflow to run daily npm audit and alert the team on new high/critical CVEs [Paste package-lock.json and npm audit output]

You are a developer experience agent. I'm providing a REST API with 30 endpoints (OpenAPI 3.0 spec) and a codebase showing the implementation. Generate complete developer documentation: 1. GETTING STARTED (500 words) — authentication setup, first API call with example response, common error handling. Code examples in Python, JavaScript, and cURL. 2. AUTHENTICATION GUIDE — OAuth2 flow with sequence diagram (ASCII), token refresh logic, scopes reference table. 3. ENDPOINT REFERENCE — for each of the 30 endpoints: - One-line description - Request/response schema with example values - All possible error codes with fix instructions - Rate limit note 4. CODE SAMPLES — working scripts for the 5 most common use cases (not hello-world — real production patterns). 5. MIGRATION GUIDE — what changed from v1, with a find-and-replace table for the 10 most common v1 patterns. 6. TROUBLESHOOTING — the 10 most common errors (infer from the codebase's error handling) with diagnosis and fix for each. Format as Markdown ready to publish to a documentation portal. [Paste OpenAPI spec and implementation excerpts]

I'm providing two versions of a 120-page enterprise SaaS Master Service Agreement (the original we signed two years ago and the renewal version the customer sent). Compare them exhaustively: 1. CHANGE SUMMARY — every clause that changed, added, or was removed, in a table: Clause reference | Change type | Old language (key phrase) | New language (key phrase) | Risk delta (Higher / Lower / Neutral) 2. HIGH-RISK CHANGES — flag any change that: - Expands our liability (SLAs, indemnification, damages caps) - Restricts our IP rights or data portability - Adds new termination triggers - Changes payment or pricing terms - Introduces new compliance obligations 3. NEGOTIATION POSITION — for each high-risk change, provide: (a) the business impact in plain language, (b) our counter-proposal language, and (c) the fallback position if they reject the counter 4. FAVOURBLE CHANGES — changes that benefit us that we should accept without negotiation 5. RECOMMENDED RESPONSE — a 3-paragraph cover note for our legal team summarising the negotiation stance [Paste both contract versions]

Design a Zero-Trust security architecture for a financial services company migrating from a traditional perimeter-based network (VPN + firewall) to cloud-native infrastructure (AWS). The company has 400 employees, 3 SaaS products, 2 internal tools, and processes cardholder data (PCI DSS scope). Deliver: 1. ZERO-TRUST PRINCIPLES MAPPING — for each of the 7 NIST SP 800-207 tenets, describe how the proposed architecture satisfies it with specific AWS services 2. IDENTITY LAYER — design the identity fabric: SSO provider, MFA policy (which users need phishing-resistant MFA?), device trust certificates, and SCIM provisioning 3. NETWORK LAYER — VPC design, security groups, service mesh, east-west traffic inspection, and how to retire the VPN incrementally 4. DATA LAYER — encryption at rest and in transit, data classification policy, and least-privilege IAM policy structure for PCI DSS scope 5. MONITORING — the exact CloudWatch, GuardDuty, and CloudTrail setup needed for continuous verification; which logs go to SIEM 6. MIGRATION ROADMAP — 6-phase migration from current state to full zero-trust, with risk assessment for each phase 7. COST MODEL — rough annual AWS cost for the proposed architecture with 400 users Include specific AWS service names and configuration decisions, not generic advice.

You are a software engineering agent completing a SWE-bench style task. Fix the following GitHub issue in the provided open-source Python library: Issue: The `DataFrame.merge()` method raises a `KeyError` when the left DataFrame has duplicate column names that also exist in the right DataFrame and `suffixes=('_x', '_y')` is specified. The error only occurs when `how='outer'` is used. Inner and left joins work correctly. Expected behaviour: Outer merge should produce a DataFrame with disambiguated column names using the specified suffixes, matching the behaviour of inner/left join. Work through this systematically: 1. REPRODUCE — write a minimal test case that triggers the bug 2. TRACE — identify the exact code path that differs between outer and inner join handling 3. ROOT CAUSE — explain precisely why outer join fails where inner doesn't 4. FIX — implement the fix with the minimal change needed (do not refactor unrelated code) 5. VERIFY — run the existing test suite mentally, confirm no regressions 6. TESTS — write 3 new tests: the original bug, the fix, and an edge case (e.g. three-way merge with overlapping columns) [Paste the library codebase and the specific file containing merge logic]