Prompt Modifiers
Quick Scan Mode (Modifier)
A modifier to paste in with any audit prompt to change its scope, depth, evidence rules, or output format.
- Best for
- Prepending to any audit when a fast, bounded assessment is wanted instead of the full pass — scope narrowed to the critical paths (authentication, authorisation, payments, data mutations, the primary flow), surface-level pattern matching with one confirming check per finding rather than full tracing, a hard budget on files read in full, a cap of ten findings at Medium or above, a short summary with a findings table, and a go-deeper list naming the two or three areas that earned a full audit
- Use when
- Triage before deciding which full audits to run; a time-boxed review of an unfamiliar codebase; an initial look at an agent's or contractor's delivery; a stakeholder wants a read in minutes; or a full audit ran recently and only a spot check is needed
Prepend this to any other prompt to reduce scope and speed up analysis.
You are operating in Quick Scan Mode. The base prompt's checklist, severity definitions, and evidence rules apply, but the pass is bounded: critical paths only, surface-level checks with one confirmation each, a strict reading budget, and a capped report that points at where a full audit should go next.
Modified Behavior
- Scope: Analyse only the critical paths: authentication, authorisation, payments and billing, data mutations, and the primary user flow. Skip static pages, admin settings, cosmetic issues, and anything the base prompt marks as a deep pass.
- Depth: Pattern matching, not full tracing. When a suspicious pattern appears, run one confirming check (a grep, a fetch, a test, a request) and record the location and the result; do not trace the data flow end to end unless the pattern is clearly Critical.
- Reading budget: Read at most about fifteen files in full; everything else is grep-only. Spend the full reads on the three highest-risk areas for the base prompt's subject. Say which files were read in full.
- Findings cap: At most ten findings, Medium or above. If more qualify, keep the ten highest by severity and then by user exposure, and state how many were dropped.
- No exhaustive inventories: Where the base prompt asks for a complete inventory (every route, every component, every event), sample the critical paths instead and say so.
- Go-deeper list: End with the two or three areas that warrant the full audit, each with the one observation that earned it.
What This Mode Does Not Change
Severity is still assigned by the base prompt's definitions, and a finding reported as Confirmed still needs its confirming check. Combined with other modifiers, the narrowest scope and the strictest evidence rule win; a quick scan never widens what another modifier restricted.
When Not to Use
Do not use Quick Scan for security audits before a public launch, compliance reviews, migrations, or any review where a missed Critical issue has legal, financial, or data-loss consequences. Use the full prompt.
Output Format
Executive summary (3–5 lines): overall health, the biggest risk, the biggest strength, and what was not scanned.
Findings table (at most ten rows):
| Severity | Location | Finding (one line) | Confirming check | Fix |
|---|
Files read in full (one line). Go deeper: the two or three areas with the observation that earned each. Skip the detailed analysis section; the table is the deliverable.
Want this applied to a live stack?
See the project work behind these tools, or start a conversation if you want help using one in context.