Summary

With a CLI provider (claude_cli, opencode_cli, ...), large files are split into chunks that each fit the token budget, but the finished prompt is larger than MAX_INPUT_BYTES (1,000,000 bytes, providers/_agent_cli.py). run_agent_cli rejects it before the CLI starts, so every analyzer fails on the same chunks in every run. The scan ends without a verdict however long it is allowed to run.

Observed

Package: rea-agents@6.5.0 from npm (morluto/rea, a legitimate open-source project; it surfaced this only because it ships large bundled dist/ files). Provider opencode_cli, model with a 272k context window (input budget 204k tokens). SkillSpector main at cf5cac7b.

Four chunks of three bundled files (~19,000 lines and ~840 KB of content each) fail in all three semantic analyzers with AgentCLIError. Rebuilt with SkillSpector's own build_prompt, the prompts are 1,002,496 to 1,008,798 bytes.

Cause

LLMAnalyzerBase.get_batches and chunk_file_by_lines budget only estimated tokens (len(text) // 4). Two things are not counted:

• the line prefix number_lines adds (L19239: , about 160 KB on 19,000 lines),
• multi-byte UTF-8: a file of CJK text can fit the token budget whole and still be over 1 MB.

The CLI transport also appends the structured-output instructions and JSON schema after build_prompt (_StructuredAgentCLIModel._augment, 2.5–4.1 KB), which no budget accounts for.

Related

• Oversized companion file causes SkillSpector to skip analysis of unrelated skill files (v2.8.2) (another malicious skill example that bypasses this scanner) #363 is about one oversized file breaking the analysis of other files. This issue is different: the chunker itself produces chunks that the CLI cap rejects.
• TP4 (mcp_tool_poisoning) builds its own chunks: TP4_MAX_FILE_CODE_BYTES is 1 MiB (1,048,576 bytes), above MAX_INPUT_BYTES, and its per-prompt check is token-only. It can hit the same cap. Not addressed in the PR below; happy to follow up.

I have a fix ready and will link the PR.