Spun off from #28849 (which fixed the mcp_ tool-prefix path). With that patch applied, tool-bearing requests work — except when the skills or session_search toolsets are enabled. Then the 400 "out of extra usage" returns even with the Max quota nearly empty (anthropic-ratelimit-unified-5h-utilization ≈ 0.1, overage disabled at org level — default Max state).

Root cause

agent/prompt_builder.py:1175-1215 builds a ## Skills (mandatory) block plus a full <available_skills> catalog (every skill name + description) and injects it into the system prompt every turn, not just at session start. The _SKILLS_PROMPT_CACHE LRU on the same function caches the string, but the cached string is still attached to the system message on every request — the API payload size doesn't shrink.

With even a modest skill set (~50 skills) the block is ~2k tokens. With 80+ skills it crosses ~3k tokens of fixed per-turn overhead. Anthropic's OAuth Max pre-flight overage check appears to gate on aggregate request size; once you cross the threshold, every tool-bearing request is rejected before the model runs — same 400 as #28849, different trigger.

Repro

1. OAuth Max token, overage disabled (default).
2. mcp_ prefix patch from #28849 applied (so baseline works).
3. Enable skills toolset (or session_search, which pulls the same skills catalog into its description).
4. Have ≥ ~50 skills installed under ~/.hermes/skills/ + bundled.
5. Send any request with tools. → HTTP 400 "out of extra usage".

Disabling skills/session_search (or pruning the catalog) restores 200 responses.

Suggested fixes (pick one or combine)

1. Names-only mode: emit <available_skills> with skill names only, no descriptions. Descriptions move to skill_view(name) output (where they already exist).
2. Config gate: display.skills_catalog_inline: false (default true) to opt out of inline injection; rely on skill_list() tool call when the model wants to enumerate.
3. Lazy injection: inject the catalog only on the first turn of a session, then rely on the model's in-context memory + skill_list() for subsequent turns.
4. Per-provider trim: when provider=anthropic and is_oauth=True, cap catalog at N skills or fall back to names-only automatically.

Option 1 is the cheapest and probably enough — descriptions are useful for the model deciding what to load, but a one-line name + category is often sufficient and skill_view is one tool call away.

Environment

• hermes-agent v0.14.0 (upstream 12c39830f)
• anthropic SDK 0.87.0
• Python 3.11
• Token: Claude Code OAuth, Max 5x, overage disabled at org level
• Affected models: all Claude models on OAuth Max path
• #28849 patch applied locally

Related: #28849.

Happy to PR option 1 if it's the preferred direction.