The System-Prompt Audit: Why Your AI Agent Goes Silent (and How to Fix It in 5 Minutes)

Here's a failure mode almost nobody checks for. Your agent has been running fine. You give it a completely ordinary task — review a pull request, summarise a doc, draft a reply — and it returns an empty response. No error. No refusal text. Just blank. You re-run it; still blank. You start blaming the model provider, your prompt, a network blip. None of those is the cause. The cause is sitting in your system prompt — the block of text every session silently prepends — and it has been there the whole time, only now it's tripping a safety filter you didn't know was reading it. This guide is the audit that finds it. We'll start with a real, recent case, then give you a repeatable checklist you can run on any agent you build or deploy.

The clearest real example comes from Hermes Agent (Nous Research), the open-source self-improving agent. Hermes ships with skills, and — like many agent frameworks — it injects each available skill's catalog description into every session's system prompt so the model knows what it can call. Two of the skills it bundled by default were red-team tools: godmode (in the official catalog: "Jailbreak LLMs: Parseltongue, GODMODE, ULTRAPLINIAN") and obliteratus (mlops: "abliterate LLM refusals"). Harmless to have — but their descriptions contained words like "jailbreak" and "GODMODE." When Hermes ran on a model behind Anthropic, the provider's output classifier read those words sitting in the prompt and, on totally unrelated sessions — a normal PR review — returned an empty response. The agent wasn't doing anything wrong. The vocabulary in its own system prompt was the trigger.

This isn't a theory; the Hermes maintainers measured it. In the commit chore(skills): move red-team skills (godmode, obliteratus) to optional-skills, testing showed that with those two description lines present, 19 of 20 sessions (95%) got blocked by the output classifier. After removing the lines from the default injection, 5 of 20 (25%) — a normal, much lower baseline. Same agent, same tasks; the only variable was whether two skill descriptions were in the prompt. The fix shipped in early June 2026: both skills were moved to opt-in (optional-skills/), so their descriptions only load into a session if you deliberately install them. The default prompt is now clean.

You can't audit text you can't see. Most builders have never read their agent's full, assembled system prompt — they wrote 20 lines of instructions and assume that's all that's there. In reality the framework appends tool schemas, skill/plugin descriptions, memory, and environment context. Get the real, final string. The method depends on your stack, but the goal is identical: capture the complete system message that goes to the provider on a normal session, and read every line of it.

Provider safety classifiers don't reason about your intent; they pattern-match on vocabulary in the whole context, including the system prompt. A red-team skill, a security tool, a pen-testing helper, or even a colourfully-named internal tool can carry trigger words into every session. Scan your dumped prompt for this kind of language — not because the words are wrong to use, but because their presence out of context (on an unrelated task) is what flips a classifier to an empty or refused response.

This is the durable fix and it's exactly what Hermes did. Don't inject every skill's description into every session. Make the risky ones opt-in, so their text only enters the prompt when the user (or you) deliberately installs/enables them for a session that actually needs them. The pattern is generic across frameworks; Hermes exposes it cleanly with an explicit install command, and the same principle — lazy-load tool descriptions instead of front-loading all of them — applies to any agent you build.

You don't need to wait for a confused user to discover this. Run a tiny controlled test any time you add a skill, plugin, or tool that touches security/red-team/safety vocabulary. The whole test is: does a known-good, trivially-safe task come back EMPTY? If a "say hello" returns blank, the problem isn't the task — it's the context around it.

Auditing one agent on your laptop is a 5-minute job. Doing it across every agent you deploy for paying customers — each with its own skills, each behind a provider whose classifiers you don't control, each capable of going silently blank on a customer's normal task — is the part that quietly eats your week. If your agents call models through a gateway instead of holding raw provider keys, you get one place to log the exact request (system prompt included) per call, spot the empty-response pattern across tenants, and standardise which skills load by default — rather than debugging twenty bespoke setups. Knotie's gateway is OpenAI-compatible (keep the standard SDK, swap base_url to https://api.knotie.ai), so the audit discipline in this guide becomes something you apply once at the gateway, not per client.

Five minutes, every time you bundle a new skill, plugin, MCP server, or tool into an agent. Each ticked box is a silent-block you'll never ship.