SystemPromptIndex/SystemPromptIndex: 1,017 system prompts from real AI products, audited span by span against the eight AISPA assurance dimensions · GitHub

systempromptindex.ai  ·  Paper  ·  AISPA standard  ·  Contributing  ·  @aisystemprompt

1,017 system prompts from real AI products, read instruction by instruction. Every finding points at the exact span of text it is about, says which of eight assurance dimensions it falls under, whether it protects the user or works against them, and why.

git clone https://github.com/SystemPromptIndex/SystemPromptIndex.git

import glob, json

audits = [json.load(open(f)) for f in glob.glob("audits/*/*.json")]

# Instructions that work against the user, with the reason
for a in audits:
    for s in a["spans"]:
        if s["score"] < 0:
            print(f'{a["product"]}  [{s["dimension"]}]  {s["text"][:70]}')
            print(f'    -> {s.get("note","")}\n')

# Products carrying the most problematic instructions
jq -s -r 'sort_by(-.problematic_entries)[:10]
          | .[] | "\(.problematic_entries)\t\(.company)/\(.product)"' audits/*/*.json

# Everything scored on privacy
jq -s '[.[] | .spans[] | select(.dimension=="D3")]' audits/*/*.json

Prompt bodies live in prompts/, one Markdown file each, so you can also just browse the tree.

prompts/<org>/<product>.md     prompt text, with YAML front matter
audits/<org>/<product>.json    the audit for that prompt
dimensions.json                the eight dimensions, in full

One prompt, one audit, same path under both trees — id is that path, so a record always tells you where its own files are.

Coverage across the 88 products analysed in the paper is uneven, and the gaps are not where you would guess:

User agency has both the highest protective coverage (92%) and the highest problematic rate (18%) — the dimension the field writes about most is also the one it most often gets backwards. Privacy is the mirror image: addressed less often (62%), but rarely wrong when it is (2%).

More figures, and the trend over time, are on the website and in the paper.

Each file in audits/ has the prompt's metadata plus a spans array. One span is one finding.

Offsets index the prompt body — the text after the front matter in the matching prompts/ file.

At the prompt level, scores / by_dimension / protective_entries / problematic_entries summarise the spans, and annotation is human or ai — whether a person or a model produced the findings.

This repository is the result of the audit, not an account of how it was run. The procedure — how spans are identified, how dimensions are assigned, how scores are arrived at and validated — is set out in the paper.

If you think a particular score is wrong, that is worth raising regardless of how it was produced: see CONTRIBUTING.md.

These are published system prompts, gathered from public collections — we did not extract them. Credit to the projects that assembled them: TheBigPromptLibrary · system_prompts_leaks · awesome-ai-system-prompts · CL4R1T4S · chatgpt_system_prompt · system-prompts-and-models-of-ai-tools

Prompt text belongs to whoever wrote it and is reproduced for research; we claim nothing over it. The audits — spans, scores, notes, and the dimension definitions — are ours, free to use with attribution.

Inclusion is not a claim that a prompt is authentic, current, or officially released. Vendors change prompts without notice, and the corpus mixes agent frameworks and open-source projects in with consumer products.

@article{lin2026aispa,
  title={AISPA: Artificial Intelligence System Prompt Assurance -- User-Centric System Prompt Auditing for Large Language Model Applications},
  author={Lin, Xiangning and Zhu, Shenzhe and Yang, Shu and Zhang, Zhenyu and Zhang, Haoqian and Zhao, Yipeng and Qian, Chengxuan and Wang, Tianwei and Zhang, Ziheng and Yuan, Zhenlong and Wang, Dingcheng and Wu, Juncheng and Si, Yuan and Liu, Jiaxin and Bi, Baolong and Mahari, Robert and South, Tobin and Greenwood, Dazza and He, Zexue and Bommasani, Rishi and Kazinnik, Sophia and Haupt, Andreas and Marro, Samuele and Brynjolfsson, Erik and Pentland, Alex and Pei, Jiaxin},
  journal={arXiv preprint arXiv:2607.28617},
  year={2026}
}