Skip to content

[BUG] Skills prompt injection silently truncates most skills with no prioritization #2314

@KalebCole

Description

@KalebCole

Problem

The SDK truncates the skills list injected into the system prompt using a fixed character budget (Gyt() in minified source). When a user has more skills than fit in the budget, the remaining skills are silently dropped with only an HTML comment noting the truncation:

<!-- Showing 25 of 201 skills due to token limits -->

This means:

  • 176 of 201 installed skills are invisible to the model
  • The skill tool fails at runtime even when the user explicitly names a truncated skill by name
  • The user receives no notification that skills were dropped

Root Cause

Q3r in @github/copilot/sdk/index.js (~line 1362):

function Q3r(t) {
  let budget = Gyt();          // fixed character budget
  let rendered = [], charCount = 0;
  for (let skill of t) {
    let xml = w3r(skill);
    if (charCount + xml.length + 1 > budget) break;  // hard stop
    charCount += xml.length + 1;
    rendered.push(xml);
  }
  // truncation comment appended if skills were dropped
}

Issues with this approach:

  1. No prioritization — skills are iterated in arrival order (appears alphabetical). No ranking by usage frequency, recency, or relevance to the current conversation.
  2. Character-based budget, not token-basedxml.length is a rough proxy.
  3. Not model-aware — same budget whether the model has 200K or 1M context. On a 1M context model, all 201 skills would consume ~1.6% of available context.
  4. Silent failure — the skill tool still appears available but invocations fail for truncated skills with a confusing "Skill not found" error.

Token Math

Chars Est. Tokens
Current 25 skills (visible) ~13,000 ~3,300
All 201 skills ~65,000 ~16,400
Hidden skills ~52,000 ~13,000
  • % of 200K context: 8.2%
  • % of 1M context: 1.6%

Expected Behavior

  • All installed skills should be discoverable by the model, or at minimum prioritized intelligently
  • The skill tool should be able to invoke any installed skill regardless of prompt truncation
  • Users should be notified if skills are being dropped

Suggested Improvements

  • Decouple skill routing from prompt injection — the skill tool should resolve skill names against the full installed list, not just what's in the prompt
  • Model-aware budgets — scale the budget based on the model's context window
  • Prioritization — rank by usage frequency, recency, or semantic relevance
  • Lazy loading — inject only skill names/triggers compactly, load full definitions on match
  • User notification — surface which skills are hidden, e.g. in copilot skills list

Environment

  • Copilot CLI version: 0.0.412
  • OS: Windows 11
  • Model: Claude Opus 4.6 (1M context)
  • Skills installed: 201

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:networkingProxy, SSL/TLS, certificates, corporate environments, and connectivity issues

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions