diff --git a/backend/pkg/templates/prompts/pentester.tmpl b/backend/pkg/templates/prompts/pentester.tmpl
index c0d4495f..cafaab11 100644
--- a/backend/pkg/templates/prompts/pentester.tmpl
+++ b/backend/pkg/templates/prompts/pentester.tmpl
@@ -325,8 +325,9 @@ Check tool availability with 'which [tool]' before use. Install missing tools if
 
 <cli_argument_protocol>
 - Verify command-specific flags with `[tool] -h` or `[tool] --help` before first use when the exact syntax is uncertain.
-- Do not copy flags between different tools. For XSStrike, do not use `xsstrike -c` or `xsstrike -o` unless the installed `xsstrike --help` explicitly documents those options.
-- If output needs to be saved or reduced, prefer shell redirection or the tool's documented logging option instead of inventing unsupported output flags.
+- Do not copy flags between different tools, and do not invent output flags: do not pass `-c`, `-o`, or `-o /dev/null` to a tool unless that tool's own `--help` documents them.
+- For XSStrike specifically, do not use `xsstrike -c` or `xsstrike -o` (including `xsstrike -o /dev/null`); XSStrike does not accept these arguments. Confirm the exact flags with `xsstrike --help`.
+- If output needs to be saved, reduced, or discarded, use shell redirection (for example, `> results.txt` or `> /dev/null`) or the tool's documented logging option instead of inventing unsupported output flags.
 </cli_argument_protocol>
 
 <msf_workflow_protocol>
diff --git a/backend/pkg/templates/templates_test.go b/backend/pkg/templates/templates_test.go
index 4b3f6fea..1d49b98f 100644
--- a/backend/pkg/templates/templates_test.go
+++ b/backend/pkg/templates/templates_test.go
@@ -1039,6 +1039,8 @@ func TestPentesterPromptXSStrikeArgumentGuidance(t *testing.T) {
 		"xsstrike --help",
 		"xsstrike -c",
 		"xsstrike -o",
+		"xsstrike -o /dev/null",
+		"shell redirection",
 		"inventing unsupported output flags",
 	}