wushenghua/hapi
1
0
Fork 0
mirror of https://github.com/wu736139669/hapi.git synced 2026-08-05 06:24:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(cli): stop prepending skill_lookup $name instruction onto user turns (#1096)

Browse Source 
Cursor ACP (and other remotes) flagged the glued-on SKILL_LOOKUP_INSTRUCTION
as prompt injection. Keep discovery on the skill_lookup MCP tool description
and on system prompts (OpenCode/Grok); do not taint user messages.

Fixes #1095

Co-authored-by: Debian <heavygee@oos-linux.in.lockhouse>
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
HeavyGee
2026-07-20 18:29:29 +01:00
committed by GitHub
co-authored by Debian Cursor
parent b74a11ecc3
commit af962fc61f
7 changed files with 30 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cli/src/modules/common/skillLookupInstruction.ts
+9
View File
@@ -1,2 +1,11 @@
/**
* Discovery copy for agents that can host a durable system / instructions block
* (OpenCode, Grok). Do **not** prepend this to user turns — that path looks like
* prompt injection on Cursor ACP and similar remotes (tiann/hapi#1095).
*
* Cursor / Kimi / generic ACP rely on the `skill_lookup` MCP tool description
* (and Cursor's native `.cursor/mcp.json` overlay where session/new mcpServers
* are ignored) instead of a user-message prepend.
*/
export const SKILL_LOOKUP_INSTRUCTION =
'When a user message starts with "$name", call HAPI\'s skill_lookup tool with "name" (without "$") before acting.'