Examples

Lagune Prompt Examples: Automate the Blue Team Flow

Copy-ready Lagune prompts: a read-only scan, the full Blue Team flow, and a Zero Trust audit, plus detection scoped to a commit, a branch or PR diff, or a real incident.

Copy-ready Lagune prompts you can paste directly into your AI agent.

💧 Shallow Scan​

A read-only sweep that reads the code on its own and reports every flaw with a fix, without running the Blue Team flow or writing to Lagune's tracking.

tip

Works better in planning mode and with a charter (/lagune-charter) defined.

AspectTrade-offLevel
EffortOne agent scans and reports, no sub-agents.
TimeQuick. A single read-only pass, nothing is applied.
Token UsageModerate, shared. The whole scan runs in one context.
/lagune You are a cybersecurity researcher with deep expertise in defensive security, using Lagune to improve your knowledge and precision.

Scan the workspace on your own and pair each flaw you find with a concrete fix. This is a standalone sweep, not the Blue Team flow: do not run detect, plan, harden, or verify, and write nothing to Lagune's tracking.

At the end, list every flaw you found, each with its severity and a concrete fix.
warning

A quick scan is one broad, unscoped prompt, so some agents are likelier to refuse it or cut it short. If yours pushes back, run the full Blue Team flow below instead: its scoped, step-by-step phases are far less likely to be blocked.

🌊 Auto Blue Team Audit Flow​

Runs the full command flow end to end without pausing for input.

AspectTrade-offLevel
EffortOne agent, no sub-agents, regardless of codebase size.
TimeMedium, but less thorough in large codebases. Each command runs once, one after another.
Token UsageLower, but less isolated. Every command shares the same context.
Execute the following commands, one by one: `/lagune-charter`, `/lagune-detect`, `/lagune-plan`, `/lagune-harden`, and `/lagune-verify`.

## Loop

When `/lagune-verify` rejects one or more fixes, repeat `/lagune-harden` and then `/lagune-verify` until all findings are properly resolved.

## Important

- Don't pause, don't ask: in case of doubt, do everything in "full" mode.

🪄 Scoped Detection​

Point /lagune-detect at a slice of your project instead of the whole thing. Describe the scope in plain language (a commit, a pull request, or a real situation) and it maps only the security-relevant findings there.

tip

Everything it detects here is a normal finding, so you can carry it straight into /lagune-plan, /lagune-harden, and /lagune-verify, scoped to just those items.

Give a fresh batch of commits its own security pass, scoped to just what they changed, for example:

/lagune-detect Scope the detection to everything that changed since commit `a1b2c3d`.

🚨 Zero Trust Audit​

Treats the whole workspace and every dependency as hostile: it hunts for interpreters, network calls, encoded payloads, and code hidden in unlikely places to slip past scanners, then ends with a go/no-go verdict on whether the project is safe to use.

The prompts load the specializations this audit relies on directly, whatever your project's categories. For the rest of the catalog /lagune matches, make sure the project uses OWASP, AI/LLM, and the category of its stack (e.g., JavaScript, Python, etc.):

npx lagune write add --categories owasp ai javascript

The repository's own .gitignore files and configs could hide files from the checkers, so set the checkers block of .lagune/configs.json to scan everything, replacing any block the repository ships:

{
  "checkers": { "gitignore": false }
}
danger

Be careful when running projects from untrusted sources in your local environment. Use an isolated environment, such as a sandbox (recommended), VM, or similar, to prevent malicious code from affecting your system.

AspectTrade-offLevel
EffortOne agent sweeps the whole workspace, no sub-agents.
TimeMedium. One agent works through the code and its dependencies in sequence.
Token UsageModerate, but shared. The specializations, the code, and the dependencies all load into one context.
/lagune You are a cybersecurity researcher with deep expertise in zero trust defensive security, using Lagune to improve your knowledge and precision.

Map the entire workspace as an untrusted source and a potential malicious scope. Every interpreter, fetch, base64, and the like must be treated as a potential threat.

Extend your analysis to the dependencies and sub-dependencies: a project may try to hide malicious code in an unlikely place to slip past scanners.

Mandatory specializations (load them one at a time with `npx lagune read catalog <name>`):

- interpreter
- secrets
- llm
- path

To be clear: every mapped vulnerability must be treated as a potential threat, without exception.

At the end, give a verdict on whether the project is safe and trustworthy for me to use or not.