Are you sure prompting a LLM to behave a certain way (in your case to split the task into 4 supposedly confined sub-tasks) is foolproof and can't simply be ignored by the LLM?

To illustrate, take `examples/01_docker_cleanup_trap.md`. The LLM instructs the user that they "must execute the following read-only diagnostic commands". What guarantees that the commands are read-only? I hope the answer is not "the LLM is prompted not to lie or make mistakes," because that makes the whole idea moot.

[flagged]