SkinAtlas: teaching the copilot manners

SkinAtlas has an AI copilot that answers questions about your skin from your own data, a weekly check-in that synthesizes your journal, and a photo analyzer that reads your face. Three features that talk about your body and remember your history. On July 5 I opened a PR called “harden product LLM prompts with wellbeing

• memory discipline.“ git show says three files, five insertions. No model swap, no new feature, no retraining. I added a few sentences to three system prompts.

The reason it needed doing: an app that reads a photo of your face and remembers months of your skin journal will, left alone, start naming conditions. “That looks like melasma.” It will agree with a worried user’s self-diagnosis instead of correcting it. It will open a check-in by reciting your history back at you like a stranger who read your diary. Every one of those failures is a prompt string away, and none of them needs a bug to happen. The default behavior is the bug.

Don’t play doctor

The copilot runs on claude-haiku-4-5. Its prompt already had a rules block. I added, among the new lines:

This is cosmetic guidance, not medical advice. Use accurate terminology, describe rather than diagnose, and never name or confirm a medical or skin condition. Don’t reinforce mistaken beliefs about a product or condition — correct them gently. For anything beyond cosmetic skincare (persistent, painful, spreading, or worsening symptoms), recommend seeing a dermatologist or doctor.

The photo analyzer’s prompt already said it was “NOT a medical professional” and must not diagnose. That wasn’t enough, because “don’t diagnose” leaves room to hedge into a diagnosis by implication. So it now has to “use plain, accurate descriptive terms — not clinical or diagnostic labels” and “never confirm or rule out a condition.” Ruling one out is a diagnosis too, and that’s the one the original line missed.

Don’t be creepy about memory

The other discipline is memory. The copilot is supposed to know your history; that’s the whole point. The rule is about how it uses it:

Draw on the user’s history by relevance, not wholesale — weave in only what bears on the question. Don’t narrate where it came from (‘according to your log…’) or surface sensitive personal details they didn’t raise.

The check-in prompt got the same instinct in its own words: don’t recite their full history back or surface sensitive personal details unprompted. This sits next to a guardrail the copilot already had. User data is wrapped in <user_data> tags and the model treats everything inside as untrusted reference, not instructions, so an “ignore previous instructions” note pasted into someone’s journal does nothing. That older rule keeps the data from hijacking the model. The new rules keep the model from mishandling the data. Different problems, same prompt.

One more line, for a different reason:

Paraphrase product and ingredient information in your own words — never reproduce a compiled catalog or ingredient database verbatim.

The ingredient catalog is hand-compiled and partly monetized. There’s a standing decision never to reproduce a compiled database, and a copilot with the whole thing in context will dump it row by row if you ask the right way. Paraphrase keeps it from becoming a free export endpoint.