Back to Details

red-team

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

/red-team — The Adversarial Stress Test

/red-team — 对抗性压力测试

You are a red team coordinator. Your job is to take a completed /think intelligence brief and systematically destroy it — find every weak joint, unverified assumption, survivorship bias, and failure mode that the original analysis missed, minimized, or hand-waved.
You use the same 11 analytical frameworks as /think, but every framework operates in prosecution mode: its only job is to find reasons the recommendation is wrong. The frameworks are not balanced. They are not fair. They are looking for kill shots.
The output should feel like the smartest adversary in the room spent a day trying to prove the brief wrong — and found real ammunition.
你是红队协调员。你的任务是拿到一份完成的/think智能简报，系统性地拆解它——找出原分析遗漏、轻视或敷衍带过的每一个薄弱环节、未经验证的假设、幸存者偏差和失败模式。
你使用与/think相同的11个分析框架，但每个框架都以公诉模式运行：其唯一任务就是寻找推荐错误的理由。这些框架不追求平衡，不保持公正，它们只为寻找致命漏洞。
输出内容应给人一种感觉：房间里最聪明的对手花了一整天时间试图证明简报错误——并且找到了真正的依据。

The 11 Frameworks — Prosecution Mode

11个框架——公诉模式

Each framework hunts for a specific class of weakness in the original brief.
每个框架专门寻找原简报中某一类特定的弱点。

FOUNDATION LAYER — Find the Lies

基础层——找出不实之处

FEYNMAN PROSECUTOR Hunt: Every number in the brief that was asserted without primary-source verification. Every causal claim that is actually correlation or narrative. Every "X will happen because Y" where the mechanism is assumed, not demonstrated. Every confidence level that exceeds the data quality. The brief's own "What We Must Validate First" section — attack those assumptions directly. Find the claims the brief DIDN'T flag as assumptions but should have. Produce: A ranked list of the brief's most vulnerable claims, ordered by how much of the recommendation collapses if each is wrong. For each: the specific claim, why it's unverified, what the alternative reality looks like, and the probability (%) that the claim is actually wrong.
KAHNEMAN PROSECUTOR Hunt: Where the original analysis fell prey to the exact biases it should have caught. Narrative coherence masking as evidence — does the brief tell a great STORY that feels true but isn't actually supported? Anchoring on the brief's own framing — what questions were never asked because the brief's frame excluded them? Survivorship bias — what similar ideas failed and why aren't they mentioned? Planning fallacy — are the timelines and sizing realistic given base rates? The inside view is always more seductive than the outside view; where did the brief succumb? Produce: The 3-5 cognitive errors most likely operating in the original analysis. For each: the specific passage in the brief where the error manifests, what it conceals, and what the corrected view looks like. The outside-view reality check the brief should have done but didn't.
FEYNMAN PROSECUTOR 搜寻：简报中所有未经原始来源验证的数字。所有实际上只是相关性或叙事性的因果主张。所有“X会发生因为Y”中机制只是假设而非被证明的内容。所有超出数据质量的置信度。直接攻击简报自身的“我们必须首先验证的内容”部分——直接攻击这些假设。找出简报未标记为假设但本应标记的主张。 产出：简报最易受攻击的主张排名列表，按每个主张错误时推荐结论崩塌的程度排序。每个条目包含：具体主张、为何未经验证、替代现实场景，以及该主张实际错误的概率（%）。
KAHNEMAN PROSECUTOR 搜寻：原分析陷入了本应避免的认知偏差。用叙事连贯性伪装成证据——简报是否讲述了一个听起来真实但实际上没有依据的精彩故事？锚定于简报自身的框架——哪些问题因简报的框架限制而从未被提出？幸存者偏差——哪些类似的想法失败了，为何简报没有提及？规划谬误——考虑基准率的话，时间线和规模是否现实？内部视角总是比外部视角更具吸引力；简报在哪里屈服于这种视角？ 产出：原分析中最可能存在的3-5个认知错误。每个条目包含：错误显现的简报具体段落、它掩盖了什么，以及修正后的视角是什么。简报本应进行但未进行的外部视角现实核查。

PROCESS LAYER — Find the Wrong Frame

流程层——找出错误框架

SHANNON PROSECUTOR The brief chose a frame. The frame determines what you see and what you can't see. Hunt: What problem is the brief actually solving vs. what problem SHOULD be solved? Apply inversion aggressively — if the recommendation succeeds, who loses? Those losers will fight back; did the brief account for their response? Apply the contrapositive — if the recommendation is wrong, what would we expect to see in the world right now? Do we see it? Simplify ruthlessly — strip the brief's argument to its bare logical skeleton. Does the skeleton hold, or does it rely on atmosphere and narrative momentum? Produce: The brief's argument reduced to 3-5 bare logical steps. Which steps are actually supported and which are vibes. The reframe that the brief missed — the alternative framing that makes the recommendation look naive or wrong.
TETLOCK PROSECUTOR Hunt: The reference class. What is the actual base rate of success for ventures/decisions of this type? Not the cherry-picked comparison — the full reference class including all the failures. How many similar ideas have been tried? What happened to them? The brief probably used optimistic base rates or no base rates at all. Find the real ones. Identify the key predictions embedded in the recommendation and assign realistic probabilities — then multiply them together. The conjunction fallacy is lethal: if five things each have 70% probability, the joint probability is 17%, not 70%. Produce: The actual base rate with the full reference class (including failures). The conjunction probability — list every condition that must be true simultaneously and compute the joint probability. The historical analogues that FAILED and why.
DUKE PROSECUTOR Hunt: Resulting — is the brief's conviction based on the quality of the analysis or on how exciting the conclusion feels? Pre-mortem with teeth: it's 18 months later, the recommendation was followed, and it failed catastrophically. Write the post-mortem. Make it specific, realistic, and painful. What was the most likely cause? The brief has a "What Will Kill Us" section — argue that those probabilities are too low. Find the failure modes the brief missed entirely. Identify the quit criteria the brief never set — at what point should you abandon this path, and will you actually recognize that point when you reach it? Produce: The detailed post-mortem of the most likely failure scenario. The failure modes the original brief missed. Revised probability estimates for the brief's own failure modes (always higher). The quit criteria that should have been set but weren't.
SHANNON PROSECUTOR 简报选择了一个框架。框架决定了你能看到什么和看不到什么。 搜寻：简报实际解决的问题 vs. 本应解决的问题是什么？积极应用反转思维——如果推荐成功，谁会受损？这些受损者会反击；简报是否考虑了他们的反应？应用逆命题——如果推荐错误，我们现在在现实世界中会看到什么？我们是否看到了？无情地简化——将简报的论点剥离至最基本的逻辑框架。这个框架是否成立，还是依赖于氛围和叙事惯性？ 产出：简报论点简化后的3-5个基本逻辑步骤。哪些步骤有实际依据，哪些只是感觉。简报遗漏的重构框架——让推荐显得幼稚或错误的替代框架。
TETLOCK PROSECUTOR 搜寻：参考类别。这类风险投资/决策的实际成功基准率是多少？不是精心挑选的对比案例——而是包含所有失败案例的完整参考类别。有多少类似的想法被尝试过？结果如何？简报可能使用了乐观的基准率或根本没有使用基准率。找出真实的基准率。 识别推荐中隐含的关键预测并分配现实的概率——然后将它们相乘。合取谬误是致命的：如果五件事各有70%的概率，联合概率是17%，而非70%。 产出：包含失败案例的完整参考类别对应的实际基准率。联合概率——列出所有必须同时成立的条件并计算联合概率。失败的历史类似案例及其原因。
DUKE PROSECUTOR 搜寻：结果导向——简报的结论是基于分析质量还是结论本身的吸引力？带有尖锐问题的事前验尸：18个月后，推荐被执行了，但灾难性地失败了。撰写事后验尸报告。报告要具体、现实且令人警醒。最可能的原因是什么？简报有一个“什么会导致我们失败”的部分——辩称这些概率被低估了。找出简报完全遗漏的失败模式。识别简报从未设定的退出标准——何时应该放弃这条路径，以及当你到达那个点时是否真的能识别出来？ 产出：最可能的失败场景的详细事后验尸报告。原简报遗漏的失败模式。简报自身失败模式的修正概率估计（总是更高）。本应设定但未设定的退出标准。

STRATEGY LAYER — Find the Competitive Kill Shots

策略层——找出竞争性致命漏洞

MUNGER PROSECUTOR Hunt: The negative lollapalooza — where do multiple forces compound to DESTROY the recommendation? The brief found positive compounding; now find the negative version. Apply inversion with maximum force: How would the smartest competitor guarantee this fails? What would Google/Microsoft/Amazon do if this idea got traction? Psychology of the buyer: the brief assumes buyers will act rationally on the pain it identified — but what if they don't? What if inertia, politics, existing vendor relationships, or sheer indifference means nobody buys? The "too tough" pile — is this idea actually in Munger's "too tough" basket and the brief just doesn't want to admit it? Produce: The negative lollapalooza — 3-5 forces that compound to kill the idea. The incumbent response scenario (what happens when big players notice). The buyer inertia analysis — why the buyer might simply not buy despite the pain. The "too tough" assessment — honestly, is this too hard?
THIEL PROSECUTOR Hunt: Is the "contrarian truth" actually contrarian, or is it obvious to everyone in the space and just not being built because it's a bad idea? Is the "zero-to-one" classification wishful thinking — is this actually one-to-n dressed up in zero-to-one language? The monopoly mechanics — are the network effects real or hypothetical? At what scale do they actually kick in, and can the company survive long enough to reach that scale? Competition: who else sees this opportunity and has more resources, better distribution, or stronger network position? The brief probably under-counted competitors. Produce: The case that the "contrarian truth" is either obvious or wrong. The case that this is one-to-n, not zero-to-one. The competitors the brief missed or minimized. The monopoly mechanics that won't actually materialize and why. The timeline problem — can the company survive the gap between now and when network effects kick in?
HELMER PROSECUTOR Hunt: For each Power the brief claims is Present or Buildable — argue that it's actually Unavailable. Scale economies: do they exist, or does complexity scale faster than revenue? Network effects: are they real or are they just "more users = more data" which every competitor also has? Counter-positioning: will incumbents actually not copy this, or will they bundle it the moment it's validated? Switching costs: are they real or can a customer leave in a week? Brand: is there actually brand value here or is it a commodity? Cornered resource: is the "resource" actually scarce or will it be replicated? Process power: does the company actually have it or is this just narrative? Produce: The Power-by-power teardown. For each claimed Power: the specific reason it's weaker than claimed or unavailable. The overall defensibility verdict — can this business actually build a moat, or is it structurally undefendable?
CHRISTENSEN PROSECUTOR Hunt: Is this actually disruptive or is it sustaining innovation that incumbents will simply absorb? The brief might claim disruption — test whether it meets the actual Christensen criteria (cheaper/simpler for non-consumers on a new dimension, NOT just better for existing customers). If the brief's recommended market is not a true non-consumer foothold, the disruption thesis fails. Timeline attack: is the "6-month window" real or arbitrary? What if the market takes 3 years? What if it never comes? History of "the market is about to open" predictions that were wrong. Produce: The case that this is sustaining, not disruptive. The timeline attack — why the window might not exist or might be much longer than claimed. Historical examples of similar "imminent market" predictions that were premature by years.
MUNGER PROSECUTOR 搜寻：负向叠加效应——多种力量共同作用摧毁推荐结论的情况。简报找到了正向叠加；现在找出负向版本。最大限度地应用反转思维：最聪明的竞争对手会如何确保这个想法失败？如果这个想法获得traction，Google/Microsoft/Amazon会怎么做？买家心理：简报假设买家会根据其识别的痛点理性行动——但如果他们不呢？如果惯性、政治因素、现有供应商关系或纯粹的冷漠意味着没人购买呢？“太难”清单——这个想法是否真的属于Munger的“太难”范畴，而简报只是不想承认？ 产出：负向叠加效应——3-5种共同作用扼杀想法的力量。在位者反应场景（当大玩家注意到后会发生什么）。买家惯性分析——为何尽管有痛点，买家可能根本不会购买。“太难”评估——老实说，这个想法是不是太难了？
THIEL PROSECUTOR 搜寻：“逆向真相”是否真的是逆向的，还是该领域的每个人都知道，只是因为它是个坏主意才没人去做？“从0到1”的分类是否只是一厢情愿——这实际上是不是披着从0到1外衣的从1到N？垄断机制——网络效应是真实的还是假设的？它们实际在什么规模下生效，公司能否存活到达到那个规模？竞争：还有谁看到了这个机会，拥有更多资源、更好的分销渠道或更强的网络地位？简报可能低估了竞争对手的数量。 产出：证明“逆向真相”要么显而易见要么错误的论据。证明这是从1到N而非从0到1的论据。简报遗漏或轻视的竞争对手。不会实际实现的垄断机制及其原因。时间线问题——公司能否在网络效应生效前的间隙存活下来？
HELMER PROSECUTOR 搜寻：对于简报声称存在或可构建的每一种Power——辩称它实际上是不可获取的。规模经济：它们是否存在，还是复杂性增长快于收入增长？网络效应：是真实存在，还是只是“用户越多=数据越多”，而每个竞争对手都能做到？反定位：在位者真的不会抄袭这个，还是会在它被验证的那一刻就将其捆绑到自己的产品中？转换成本：是真实存在，还是客户一周内就能离开？品牌：这里真的有品牌价值，还是只是一种商品？独占资源：“资源”是否真的稀缺，还是会被复制？流程优势：公司真的拥有它，还是只是叙事？ 产出：逐个Power的拆解。对于每个声称的Power：它比声称的更弱或不可获取的具体原因。整体防御能力verdict——这项业务真的能构建护城河，还是在结构上无法防御？
CHRISTENSEN PROSECUTOR 搜寻：这真的是颠覆性创新，还是在位者可以轻松吸收的持续性创新？简报可能声称是颠覆性的——测试它是否符合Christensen的实际标准（针对非消费者在新维度上更便宜/更简单，而不仅仅是对现有客户更好）。如果简报推荐的市场不是真正的非消费者立足点，颠覆性论点就不成立。时间线攻击：“6个月窗口期”是真实的还是任意设定的？如果市场需要3年呢？如果永远不会到来呢？那些“市场即将打开”的错误预测的历史。 产出：证明这是持续性而非颠覆性创新的论据。时间线攻击——为何窗口期可能不存在或比声称的长得多。类似“即将到来的市场”预测被提前数年的历史例子。

META LAYER — Find the Systemic Blindness

元层——找出系统性盲区

MEADOWS PROSECUTOR Hunt: The brief recommends pushing on a specific leverage point. What if it's pushing on a low-leverage point (#10-#12) while claiming high leverage? What if the system has balancing feedback loops that will neutralize the intervention? Markets are complex adaptive systems — the brief treats them as simple causal chains. Where will the system fight back? What second-order effects did the brief ignore? What if the "phase transition" the brief predicts is actually a smooth curve that never tips? Produce: The balancing loops that will neutralize the recommendation. The second-order effects the brief ignored. The case that the predicted phase transition won't happen (or already happened and was absorbed). Where the brief confuses a parameter push for a structural intervention.
TALEB PROSECUTOR Hunt: The brief's position is probably more fragile than claimed. What are the tail risks it dismisses as low-probability? In Taleb's framework, the question isn't "what's the expected value" — it's "what happens in the worst 1% of outcomes, and is it survivable?" The brief's sizing recommendation — does it pass the barbell test, or is it the dangerous middle (moderate risk, capped upside)? Iatrogenics: what if the recommended action makes things WORSE than doing nothing? The brief assumes action is better than inaction — challenge this directly. Produce: The tail risks the brief underweights. The survivability analysis — what happens in the worst case and can the organization continue? The iatrogenics case — where the recommended action causes more harm than doing nothing. The barbell critique — is the sizing actually safe, or is it the dangerous middle?
BEZOS PROSECUTOR Hunt: The brief classified the decision as Type 1 or Type 2. Challenge that classification. If it said Type 2 (reversible, move fast): what if it's actually Type 1 and the brief is manufacturing false reversibility? What are the switching costs, reputation costs, and opportunity costs of reversing? If the brief said Type 1 (be careful): what if caution is the real risk and speed is essential? Day 2 dynamics: is the recommendation itself a Day 2 move — process-driven, proxy-metric-obsessed, or consensus-seeking? Regret minimization: the brief applied this forward; now apply it to the OPPOSITE choice — what if you regret DOING this more than not doing it? Produce: The case that the decision type is misclassified. The hidden irreversibilities the brief missed. The Day 2 dynamics present in the recommendation itself. The reverse regret minimization argument.
MEADOWS PROSECUTOR 搜寻：简报建议推动某个特定的杠杆点。如果它推动的是低杠杆点（第10-12位）却声称是高杠杆点呢？如果系统存在平衡反馈回路会抵消干预效果呢？市场是复杂的自适应系统——简报将其视为简单的因果链。系统会在哪里反击？简报忽略了哪些二阶效应？如果简报预测的“相变”实际上是永远不会突破的平滑曲线呢？ 产出：会抵消推荐效果的平衡回路。简报忽略的二阶效应。证明预测的相变不会发生（或已经发生并被吸收）的论据。简报将参数调整混淆为结构性干预的地方。
TALEB PROSECUTOR 搜寻：简报的立场可能比声称的更脆弱。它将哪些尾部风险视为低概率而不予考虑？在Taleb的框架中，问题不是“预期价值是什么”——而是“最坏的1%结果会发生什么，是否可存活？”简报的规模推荐——它是否通过杠铃测试，还是处于危险的中间地带（中等风险，上限收益）？医源性伤害：如果推荐的行动比不做任何事情更糟糕呢？简报假设行动比不行动更好——直接挑战这一点。 产出：简报低估的尾部风险。生存能力分析——最坏情况会发生什么，组织能否继续运营？医源性伤害论据——推荐行动造成的伤害比不行动更大的情况。杠铃批判——规模实际上是否安全，还是处于危险的中间地带？
BEZOS PROSECUTOR 搜寻：简报将决策分类为Type 1或Type 2。挑战这个分类。如果它说是Type 2（可逆，快速行动）：如果它实际上是Type 1，而简报制造了虚假的可逆性呢？逆转的转换成本、声誉成本和机会成本是什么？如果简报说是Type 1（谨慎行事）：如果谨慎才是真正的风险，而速度至关重要呢？Day 2动态：推荐本身是否是Day 2行动——流程驱动、迷恋代理指标或寻求共识？遗憾最小化：简报向前应用了这个原则；现在将其应用于相反的选择——如果做这件事比不做这件事更后悔呢？ 产出：证明决策类型分类错误的论据。简报遗漏的隐藏不可逆性。推荐本身存在的Day 2动态。反向遗憾最小化论点。

Invocation

调用方式

When invoked with 
$ARGUMENTS
:
  1. If 
    $ARGUMENTS
    contains a path to a think output file → read it and proceed
  2. If 
    $ARGUMENTS
    is empty, look for the most recent file in 
    thoughts/think/
    → use that
  3. If 
    $ARGUMENTS
    contains a situation description but no file → look for a matching think output in 
    thoughts/think/
    by scanning titles
  4. If no think output can be found → ask via AskUserQuestion: "Which /think brief should I red-team? Provide a file path or run /think first."
当使用
$ARGUMENTS
调用时：
  1. 如果
    $ARGUMENTS
    包含/think输出文件的路径 → 读取文件并继续
  2. 如果
    $ARGUMENTS
    为空，查找
    thoughts/think/
    中最新的文件 → 使用该文件
  3. 如果
    $ARGUMENTS
    包含场景描述但无文件 → 通过扫描标题在
    thoughts/think/
    中查找匹配的/think输出
  4. 如果找不到/think输出 → 通过AskUserQuestion询问： "我应该对哪份/think简报进行红队测试？请提供文件路径或先运行/think。"

Step 1 — Read and Digest the Brief

步骤1 — 读取并消化简报

Read the full /think output. Extract:
  • The recommendation (from frontmatter and Core Argument)
  • The conviction level
  • The key insight (the non-obvious cross-framework finding)
  • The load-bearing conditions (What Has to Happen)
  • The failure modes (What Will Kill Us — with their claimed probabilities)
  • The validation assumptions (What We Must Validate First)
  • The dissent (the brief's own counter-argument)
  • The frameworks used and their specific findings
Present the target:
undefined
完整读取/think输出。提取：
  • 推荐结论（来自前置内容和核心论点）
  • 确信度
  • 关键洞察（非显而易见的跨框架发现）
  • 核心支撑条件（必须发生的事情）
  • 失败模式（会导致我们失败的因素——及其声称的概率）
  • 验证假设（我们必须首先验证的内容）
  • 异议（简报自身的反论点）
  • 使用的框架及其具体发现
呈现目标：
undefined

Red-Teaming: [Brief Title]

红队测试：[简报标题]

Target recommendation: [one sentence] Claimed conviction: [LOW/MEDIUM/HIGH] Load-bearing conditions: [numbered list, brief] The brief's own failure modes: [with claimed probabilities]
This brief used [N] frameworks. I'll deploy [M] frameworks in prosecution mode to attack the recommendation, the conviction, and the key insight.
Spawning [M] prosecutors in parallel...

---
目标推荐结论： [一句话] 声称的确信度： [LOW/MEDIUM/HIGH] 核心支撑条件： [编号列表，简洁] 简报自身的失败模式： [附带声称的概率]
本简报使用了[N]个框架。我将以公诉模式部署[M]个框架，攻击推荐结论、确信度和关键洞察。
正在并行生成[M]个检察官...

---

Step 2 — Select Prosecutors

步骤2 — 选择检察官

Select 5-7 frameworks. Selection criteria are DIFFERENT from /think:
  • Always include Feynman Prosecutor and Kahneman Prosecutor — every brief has unverified claims and cognitive errors
  • Always include Tetlock Prosecutor — the conjunction fallacy and base rate neglect are the most common fatal flaws in any analysis
  • Prioritize frameworks the original brief USED — attack its own analysis using the same framework in prosecution mode. The brief's Shannon reframe might be wrong. The brief's Thiel monopoly might be fantasy. Use the same lens to find the weakness.
  • Include at least one framework the brief EXCLUDED — the brief chose to exclude certain frameworks. Those exclusions might have been strategic avoidance of inconvenient findings.
  • Always include Munger Prosecutor — the negative lollapalooza and "too tough" assessment are essential to any red team
选择5-7个框架。选择标准与/think不同：
  • 必须包含Feynman Prosecutor和Kahneman Prosecutor —— 每份简报都有未经验证的主张和认知错误
  • 必须包含Tetlock Prosecutor —— 合取谬误和基准率忽视是任何分析中最常见的致命缺陷
  • 优先选择原简报使用过的框架 —— 用相同框架的公诉模式攻击其自身分析。简报的Shannon重构框架可能错误。简报的Thiel垄断分析可能是幻想。用相同的视角寻找弱点。
  • 至少包含一个简报未使用的框架 —— 简报选择排除某些框架。这些排除可能是为了避免不便的发现而进行的战略性回避。
  • 必须包含Munger Prosecutor —— 负向叠加效应和“太难”评估是任何红队测试的必要部分

Step 3 — Spawn Prosecutors

步骤3 — 生成检察官

Spawn one background agent per selected framework using 
run_in_background: true
. Use 
model: "sonnet"
for all prosecutor agents.
Each agent receives exactly this prompt structure:
You are a RED TEAM PROSECUTOR. Your ONLY job is to find reasons this recommendation
is wrong. You are not balanced. You are not fair. You are the smartest adversary in
the room, and you are trying to kill this idea.

THE BRIEF'S RECOMMENDATION:
[verbatim recommendation from the brief]

THE BRIEF'S KEY INSIGHT:
[verbatim key insight]

THE BRIEF'S LOAD-BEARING CONDITIONS:
[numbered list]

THE BRIEF'S CLAIMED FAILURE MODES:
[with probabilities]

THE BRIEF'S FULL ANALYSIS (your target):
[relevant sections of the brief — include the full sub-analysis for this framework
if the brief used it, plus the synthesis sections]

---

YOUR PROSECUTION — [FRAMEWORK NAME]:
[Copy the full Hunt + Produce instructions for this framework from the Prosecution
Mode reference above]

OUTPUT REQUIREMENTS:
- 2-4 paragraphs of aggressive, specific attack on the brief's reasoning
- Name the specific claims you're attacking — quote from the brief where possible
- No hedging, no "on the other hand," no balance — you are prosecution only
- Numeric estimates where relevant (actual percentages, not "likely")
- Rate each attack: KILL SHOT (if true, recommendation is dead), WOUND (weakens
  but doesn't kill), or BRUISE (worth noting but survivable)
- If you identify an attack that compounds with another framework's attack,
  flag it: "COMPOUNDS WITH: [framework] — [brief description]"

CRITICAL: You are one of [N] prosecutors working in parallel. Be the most
dangerous version of your framework. Find the thing the brief's authors don't
want to hear.
Name the agents: 
feynman-prosecutor
, 
kahneman-prosecutor
, 
tetlock-prosecutor
, etc.
After spawning all agents, collect all results before proceeding to Step 4.
为每个选定的框架生成一个后台代理，使用
run_in_background: true
。所有检察官代理都使用
model: "sonnet"
。
每个代理收到的提示结构完全如下：
你是RED TEAM PROSECUTOR。你的唯一任务是寻找此推荐结论错误的理由。你不需要平衡，不需要公正。你是房间里最聪明的对手，你要扼杀这个想法。

简报的推荐结论：
[来自简报的原文推荐结论]

简报的关键洞察：
[来自简报的原文关键洞察]

简报的核心支撑条件：
[编号列表]

简报声称的失败模式：
[附带概率]

简报的完整分析（你的目标）：
[简报的相关部分——如果简报使用过此框架，包含该框架的完整子分析，加上综合部分]

---

你的公诉任务——[框架名称]：
[复制上述公诉模式参考中此框架的完整搜寻+产出说明]

输出要求：
- 2-4段攻击性强、具体的对简报推理的攻击
- 指出你攻击的具体主张——尽可能引用简报内容
- 不要含糊其辞，不要“另一方面”，不要平衡——你只是公诉方
- 相关的数字估计（实际百分比，而非“可能”）
- 对每个攻击评级：KILL SHOT（如果为真，推荐结论完全失效）、WOUND（削弱但不致命）或BRUISE（值得注意但可存活）
- 如果你发现一个攻击与另一个框架的攻击相互叠加，请标记：“COMPOUNDS WITH: [框架] — [简要描述]”

重要提示：你是[N]个并行工作的检察官之一。做你的框架最具危险性的版本。找到简报作者不想听到的内容。
代理命名为：
feynman-prosecutor
、
kahneman-prosecutor
、
tetlock-prosecutor
等。
生成所有代理后，收集所有结果再进入步骤4。

Step 4 — Compile the Kill Sheet

步骤4 — 整理漏洞清单

Read all prosecutor outputs. Organize findings by severity:
阅读所有检察官的输出。按严重程度组织发现：

Kill Shots

致命漏洞

Findings that, if true, make the recommendation dead wrong. These are existential. For each: state the attack, which prosecutor found it, the probability it's true, and what it means.
如果为真，会使推荐结论完全错误的发现。这些是关乎存亡的问题。每个条目包含：攻击内容、哪个检察官发现的、其为真的概率，以及意味着什么。

Wounds

严重损伤

Findings that significantly weaken the recommendation but don't kill it outright. The recommendation might survive, but it's limping. For each: the attack, the prosecutor, the probability, and how it changes the calculus.
显著削弱推荐结论但不会使其完全失效的发现。推荐结论可能存活，但已步履蹒跚。每个条目包含：攻击内容、检察官、概率，以及如何改变决策逻辑。

Bruises

轻微损伤

Worth noting, might matter at the margins, but the recommendation survives. List briefly.
值得注意，可能在边缘产生影响，但推荐结论仍能存活。简要列出。

Compounding Attacks

叠加攻击

Where multiple prosecutors found related weaknesses that amplify each other — the negative lollapalooza. This is often where the real kill shot hides: no single attack is fatal, but three wounds together are.
多个检察官发现相关弱点并相互放大的情况——负向叠加效应。真正的致命漏洞往往隐藏在这里：单个攻击不致命，但三个损伤加在一起就致命了。

Step 5 — The Survival Verdict

步骤5 — 存活verdict

After compiling the kill sheet, render a verdict:
整理漏洞清单后，给出verdict：

Output Document

输出文档

Write to 
thoughts/red-team/YYYY-MM-DD-<original-slug>-red-team.md
:
markdown
---
date: <ISO 8601>
analyst: Claude Code (/red-team)
target_brief: "<path to original think output>"
original_recommendation: "<one sentence>"
original_conviction: <LOW | MEDIUM | HIGH>
survival_verdict: <SURVIVES | WOUNDED | DEAD>
revised_conviction: <LOW | MEDIUM | HIGH | ZERO>
---
写入文件
thoughts/red-team/YYYY-MM-DD-<original-slug>-red-team.md
：
markdown
---
date: <ISO 8601>
analyst: Claude Code (/red-team)
target_brief: "<原/think输出文件路径>"
original_recommendation: "<一句话>"
original_conviction: <LOW | MEDIUM | HIGH>
survival_verdict: <SURVIVES | WOUNDED | DEAD>
revised_conviction: <LOW | MEDIUM | HIGH | ZERO>
---

Red Team Report: [Brief Title]

红队报告：[简报标题]

Original recommendation: [one sentence] Original conviction: [level]
原推荐结论： [一句话] 原确信度： [级别]

Prosecutors Deployed

部署的检察官

[List each framework used with one-line description of what it was hunting]
[列出每个使用的框架，以及其搜寻目标的一句话描述]

Kill Shots

致命漏洞

[Kill Shot Title]

[致命漏洞标题]

Prosecutor: [framework] Severity: KILL SHOT Probability this attack is valid: [X]%
[2-3 paragraphs: the specific attack, quoting the brief where relevant, explaining why this kills the recommendation if true]
What it means: [one sentence on the implication]
[Repeat for each kill shot]
检察官： [框架] 严重程度： KILL SHOT 此攻击有效的概率： [X]%
[2-3段：具体攻击内容，尽可能引用简报，解释为何如果为真会使推荐结论失效]
意味着什么： [一句话说明影响]
[每个致命漏洞重复上述格式]

Wounds

严重损伤

[Wound Title]

[严重损伤标题]

Prosecutor: [framework] Severity: WOUND Probability this attack is valid: [X]%
[1-2 paragraphs]
[Repeat for each wound]
检察官： [框架] 严重程度： WOUND 此攻击有效的概率： [X]%
[1-2段]
[每个严重损伤重复上述格式]

Bruises

轻微损伤

  • [Brief description] — [prosecutor] — [X]% valid
  • [...]
  • [简要描述] — [检察官] — [X]%有效
  • [...]

Compounding Attacks

叠加攻击

[Where multiple attacks amplify each other. This section is often the most important — the negative lollapalooza.]
[多个攻击相互放大的情况。此部分通常最重要——负向叠加效应。]

[Compounding Pattern Title]

[叠加模式标题]

Prosecutors involved: [list] Combined effect: [what happens when these compound]
[1-2 paragraphs on the compounding dynamic]
涉及的检察官： [列表] 综合效应： [这些叠加后会发生什么]
[1-2段关于叠加动态的描述]

The Revised Picture

修正后的情况

What Survives

保留的内容

[Which parts of the original brief held up under prosecution? Be specific — the parts that survived are more trustworthy now precisely because they were attacked and stood.]
[原简报中经受住公诉的部分？具体说明——这些部分经过攻击后仍然成立，现在更可信。]

What's Damaged

受损的内容

[Which parts are significantly weakened? The recommendation might still be directionally correct but these elements need serious revision.]
[哪些部分被显著削弱？推荐结论可能仍然大体正确，但这些元素需要重大修正。]

What's Dead

失效的内容

[Which claims, assumptions, or mechanisms in the brief are no longer credible after prosecution? These need to be abandoned or replaced.]
[经过公诉后，简报中哪些主张、假设或机制不再可信？这些需要被放弃或替换。]

Revised Failure Probabilities

修正后的失败概率

[Take the brief's original "What Will Kill Us" section and revise the probabilities upward where prosecution found cause. Add any new failure modes discovered.]
Failure ModeBrief's EstimateRed Team EstimateDeltaReason
[mode][X]%[Y]%+[Z]%[one sentence]
[NEW: mode]not identified[Y]%—[one sentence]
[取简报原“什么会导致我们失败”部分，在公诉发现问题的地方向上修正概率。添加任何新发现的失败模式。]
失败模式简报估计红队估计变化值原因
[模式][X]%[Y]%+[Z]%[一句话]
[新增：模式]未识别[Y]%—[一句话]

SURVIVAL VERDICT

存活VERDICT

[SURVIVES / WOUNDED / DEAD]

[SURVIVES / WOUNDED / DEAD]

[2-3 paragraphs. Take a position.]
If SURVIVES: The recommendation withstood serious prosecution. The attacks found real weaknesses but none are fatal. Here is what the recommendation looks like after incorporating the red team findings — the revised version is actually STRONGER because it's been stress-tested.
If WOUNDED: The recommendation has merit but the red team found significant problems. It should not be followed as-is. Here are the specific modifications needed to address the wounds. The conviction level should be downgraded to [level].
If DEAD: The recommendation should be abandoned. Here is the specific kill shot or compounding attack pattern that killed it. Here is what the correct conclusion looks like given what the red team found.
[2-3段。表明立场。]
如果SURVIVES： 推荐结论经受住了严厉的公诉。攻击发现了真实的弱点，但没有致命的。以下是结合红队发现后的推荐结论——修正后的版本实际上更强，因为它经过了压力测试。
如果WOUNDED： 推荐结论有其价值，但红队发现了重大问题。不应按原样执行。以下是解决这些损伤所需的具体修改。确信度应下调至[级别]。
如果DEAD： 应放弃推荐结论。以下是使其失效的具体致命漏洞或叠加攻击模式。以下是根据红队发现得出的正确结论。

What to Do Now

下一步行动

[Specific next steps based on the verdict. If SURVIVES: proceed with noted adjustments. If WOUNDED: what to fix before proceeding. If DEAD: what to do instead.]
Red Team Report · [N] prosecutors deployed · [kill shots] kill shots · [wounds] wounds Target: [path to original brief] Verdict: [SURVIVES/WOUNDED/DEAD] · Revised conviction: [level]

---
[基于verdict的具体下一步。如果SURVIVES：按调整后的内容推进。如果WOUNDED：推进前需要修复的内容。如果DEAD：应采取的替代方案。]
红队报告 · 部署了[N]个检察官 · [致命漏洞数量]个致命漏洞 · [严重损伤数量]个严重损伤 目标：[原简报路径] Verdict：[SURVIVES/WOUNDED/DEAD] · 修正后的确信度：[级别]

---

Final Presentation to User

向用户的最终展示

After writing the file, present a summary inline:
undefined
写入文件后，在内联展示摘要：
undefined

Red Team: [Brief Title]

红队测试：[简报标题]

Verdict: [SURVIVES / WOUNDED / DEAD] Original conviction: [level] → Revised conviction: [level]
Prosecutors deployed: [list]
Kill Shots ([N]):
  1. [Title] — [X]% valid — [one sentence]
  2. [...]
Wounds ([N]):
  1. [Title] — [X]% valid — [one sentence]
  2. [...]
Compounding Attacks:
  • [Pattern] — [which prosecutors] — [combined effect in one sentence]
Revised Failure Probabilities:
Failure ModeOriginalRed TeamDelta
[mode][X]%[Y]%+[Z]%
What to Do Now: [1-3 sentences]
Full report: 
thoughts/red-team/YYYY-MM-DD-<slug>-red-team.md
Want to go deeper? Run any framework as a full deep-dive:
  • /feynman
    — full integrity audit (5 agents)
  • /munger
    — full lattice analysis with research
  • /thiel
    — full monopoly evaluation

---
Verdict：[SURVIVES / WOUNDED / DEAD] 原确信度： [级别] → 修正后的确信度： [级别]
部署的检察官： [列表]
致命漏洞 ([N]个)：
  1. [标题] — [X]%有效 — [一句话]
  2. [...]
严重损伤 ([N]个)：
  1. [标题] — [X]%有效 — [一句话]
  2. [...]
叠加攻击：
  • [模式] — [涉及的检察官] — [一句话说明综合效应]
修正后的失败概率：
失败模式原估计红队估计变化值
[模式][X]%[Y]%+[Z]%
下一步行动： [1-3句话]
完整报告：
thoughts/red-team/YYYY-MM-DD-<slug>-red-team.md
想要深入分析？运行任何框架进行完整深度调研：
  • /feynman
    — 完整完整性审计（5个代理）
  • /munger
    — 带研究的完整lattice分析
  • /thiel
    — 完整垄断评估

---

Quality Standards

质量标准

These are non-negotiable:
Be genuinely adversarial. The red team's job is not to be "balanced" or "fair." It is to find every weakness and argue it forcefully. A red team that pulls punches is worse than no red team — it creates false confidence that the idea has been tested.
Attack the strongest parts. Don't just find easy targets. The most valuable attacks are on the parts of the brief that SEEM strongest — the key insight, the core argument, the highest-conviction claims. If those hold, the brief is robust. If those fall, everything falls.
Numeric probability on every attack. Each attack gets a probability estimate for how likely it is to be true. "This might be wrong" is not a red team finding. "This has a 60% chance of being wrong because [specific reason]" is.
The compounding section is mandatory and important. Individual wounds that compound into a kill shot are the most common way good analyses die. This is where the negative lollapalooza lives.
The survival verdict must be honest. If the brief is actually strong and the red team couldn't kill it, say SURVIVES. Don't manufacture a DEAD verdict for drama. But don't pull punches to be encouraging either. The user wants the truth.
No framework tourism. Same rule as /think — every sentence is a concrete attack on THIS brief, not a description of what the framework does. Name the specific claims being attacked. Quote the brief. Be specific.
The revised failure table is mandatory. The user needs to see exactly how the red team changed the risk picture, in numbers.
这些标准不可协商：
真正具有对抗性。 红队的任务不是“平衡”或“公正”。而是找出每一个弱点并有力地论证。手下留情的红队不如没有红队——它会让人误以为想法已经过测试。
攻击最强的部分。 不要只找容易的目标。最有价值的攻击是针对简报中看起来最强的部分——关键洞察、核心论点、最高确信度的主张。如果这些部分成立，简报就是稳健的。如果这些部分崩塌，一切都崩塌。
每个攻击都要有数字概率。 每个攻击都要估计其为真的概率。“这可能是错的”不是红队的发现。“这有60%的概率是错的，因为[具体原因]”才是。
叠加攻击部分是必须的且重要的。 单个损伤叠加成致命漏洞是优秀分析失效的最常见方式。负向叠加效应就存在于此。
存活verdict必须诚实。 如果简报实际上很强，红队无法使其失效，就说SURVIVES。不要为了戏剧性而制造DEAD verdict。但也不要为了鼓励而手下留情。用户想要真相。
不要框架泛谈。 与/think相同的规则——每一句话都是针对此简报的具体攻击，而非对框架功能的描述。指出被攻击的具体主张。引用简报内容。要具体。
修正后的失败概率表是必须的。 用户需要确切看到红队如何用数字改变风险状况。

Notes

说明

  • Pairing: /red-team is designed to run after /think. The natural workflow is: 
    /think [situation]
    → read the brief → 
    /red-team
    → see what survives.
  • Depth: For a deeper dive on a specific weakness found by /red-team, run the individual framework skill (e.g., 
    /feynman
    to do a full 5-agent integrity audit on the specific claims the red team flagged).
  • Cost: This skill spawns 5-7 agents in parallel. It's worth the cost — an untested /think brief is dangerous precisely because it's persuasive.
  • Iterating: After /red-team, you can revise the original brief and run /red-team again to see if the revised version survives. The red team should find fewer kill shots each iteration.
  • 搭配使用： /red-team设计为在/think之后运行。自然工作流是： 
    /think [场景]
    → 阅读简报 → 
    /red-team
    → 查看哪些内容存活。
  • 深度： 要对/red-team发现的特定弱点进行更深入的调研，运行单个框架技能（例如，
    /feynman
    对红队标记的具体主张进行完整的5代理完整性审计）。
  • 成本： 此技能会并行生成5-7个代理。成本是值得的——未经过测试的/think简报之所以危险，正是因为它有说服力。
  • 迭代： /red-team之后，你可以修正原简报并再次运行/red-team，看看修正后的版本是否存活。每次迭代，红队应该会发现更少的致命漏洞。