sap-migration-dossier — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sap-migration-dossier (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build a migration planning artifact, not a one-object fix workflow. Use this skill to combine the existing ARC-1 migration skills into a scoped dossier that is easy to start and can become more formal only when the user asks.
Default to a concise chat report. Offer files, review cards, HTML, CSV/JSON, and graphs as optional follow-ups; do not ask the user to design a reporting system up front.
Read references/auditor-patterns.md only when the user asks for persistent artifacts, human review, imported extracts, deep ECC enhancement extraction, integrity hashes, HTML dashboards, or graph output.
Use SAP Docs MCP when available, especially for Clean Core/API status, successor APIs, release-specific syntax, and migration guidance. If SAP Docs MCP is not connected, still run the dossier with ARC-1 evidence and list "SAP Docs MCP unavailable" as an evidence gap.
If the scope is clear, start immediately:
SAPRead(type="DEVC", name="<package>")SAPSearch per relevant type (PROG, CLAS, FUGR, FUNC, DDLS, BDEF, SRVD, TABL)SAPSearchSAPDiagnose(action="atc", type="<type>", name="<name>")sap-clean-core-atc logicsap_get_object_details; use search/fetch for the top ATC themes or replacement guidancesap-unused-code only if SCMON/SUSG data is availableSAPContext or SAPNavigate(action="references")Ask only when required:
Use optional modes only when the user asks or the scope makes chat output impractical.
| User asks for | Do this |
|---|---|
| "save it", "share it", "dossier", "client report" | Create docs/migration-dossiers/<scope>/<date>/ with report.md and optional inventory.csv |
| "HTML", "PDF", "dashboard" | Generate a self-contained report.html; mention it can be printed to PDF |
| "reviewed", "consultant validation", "not AI-only" | Create draft cards and include only validated/corrected cards in the final report |
| "graph", "visualize", "dependency map" | Generate a bounded Mermaid graph for the top risk/high-fanout objects |
| "deep ECC", "user exits", "BAdIs", "standard modifications" | Use deep evidence from references/auditor-patterns.md; only use SAPQuery when allowed |
| "successor API", "released API", "what replaces this" | Use SAP Docs MCP sap_get_object_details, then search/fetch for guidance if needed |
| "will this syntax work on release X" | Use SAP Docs MCP abap_feature_matrix plus search with the right ABAP flavor |
| "fix this" | Switch to migrate-custom-code for selected findings; this skill should not mass-remediate |
For chat output, keep it short:
Migration Dossier - <scope>
Scope: <n> objects, <types>, <packages>
Evidence: ATC=<variant/default>, docs=<SAP Docs MCP/unavailable>, usage=<SCMON/SUSG/unavailable>, clean-core=<source>, dependencies=<source>
Summary:
- <1-3 lines>
Priority objects:
| Object | Why it matters | Suggested action |
Retirement candidates:
| Object | Evidence | Caveat |
Main risks:
- <ATC/Clean Core/standard modification themes>
Evidence gaps:
- <missing usage data, skipped objects, dynamic calls, unavailable variants>
Next step:
- <one recommendation>For file output, keep the default artifact set small:
docs/migration-dossiers/<scope>/<date>/
report.md
inventory.csv
methodology.mdAdd report.html, cards.jsonl, reviews.jsonl, graph.mmd, or dashboard.html only when requested.
Use a human review gate only for customer-facing or decision-grade reports.
Statuses:
ai_draft | validated | corrected | skipped | ai_errorClassifications:
REMOVE | KEEP | ADAPT | COVERED_BY_STANDARD | UNDETERMINEDKeep these separate from the decision:
cleanCoreLevel: A | B | C | D | unknown
usageStatus: USED | LIKELY_UNUSED | UNUSED | INDETERMINATEFinal reviewed reports must exclude ai_draft cards unless explicitly labeled as drafts.
SAPQuery unless free SQL is enabled and the user chose deep evidence.$TMP or ATC skipped it.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.