setup-abap-mirror — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited setup-abap-mirror (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Create a local abapGit-style mirror of an SAP package or object set. Reads are authoritative from the SAP system; local files give you IDE context, git diff, and fast searching without round-tripping every time.
This skill works today with ARC-1's existing SAPRead + DEVC primitives. When dedicated abapGit export tooling lands in ARC-1, the skill can be simplified — the file layout it produces is the target format either way.
| Setting | Default | Rationale |
|---|---|---|
| Mirror root | ./mirror/<SID>/src/<package>/ | Groups by system to support multi-system work |
| File naming | abapGit conventions | Standard; future-proof |
| Recurse sub-packages | Yes | Matches abapGit behaviour |
| Include test classes | Yes | Tests belong with the class |
| Include metadata XML | Skip for now | ARC-1 does not yet emit abapGit-format XML; source-only is useful and safe |
One of the following scopes:
name + type (e.g., ZCL_TRAVEL_HANDLER, CLAS){ type, name } pairspackage name; pulls everything insideOptionally:
./mirror/<SID>/src/<package>/)Before running, ensure system-info.md exists. If it doesn't:
→ Run the bootstrap-system-context skill firstThe mirror header references SID, system type, and release from system-info.md.
SAPRead(type="DEVC", name="<PACKAGE>")Returns [{ type, name, description, uri }, ...] where type is slash-form (CLAS/OC, DDLS/DF, PROG/P, DEVC/K, etc.).
For each DEVC/K entry (sub-package): recurse — call SAPRead(type="DEVC", name=<sub>) and append its contents.
Normalize slash-form types to the ARC-1 SAPRead short codes:
| Slash form | SAPRead type | abapGit extension |
|---|---|---|
CLAS/OC | CLAS | .clas.abap (+ .clas.testclasses.abap) |
INTF/OI | INTF | .intf.abap |
PROG/P | PROG | .prog.abap |
FUGR/F | FUGR | .fugr.abap (expanded includes) |
FUNC/FF | FUNC | .func.abap |
DDLS/DF | DDLS | .ddls.asddls |
DCLS/DL | DCLS | .dcls.asdcls |
DDLX/EX | DDLX | .ddlx.asddlxs |
BDEF/BO | BDEF | .bdef.asbdef |
SRVD/SRV | SRVD | .srvd.asrvd |
SRVB/SVB | SRVB | .srvb.xml |
TABL/DT | TABL | .tabl.xml |
STRU/DS | STRU | .stru.xml |
DOMA/DD | DOMA | .doma.xml |
DTEL/DE | DTEL | .dtel.xml |
MSAG/N | MSAG | .msag.xml |
ENHO/EO | ENHO | .enho.xml |
Skip types not in this table; log them in a skipped.md in the mirror root.
Skip enumeration; proceed directly with the provided list.
For every resolved { type, name }:
SAPRead(type="<type>", name="<name>")For classes, also fetch test classes (unless skipped):
SAPRead(type="CLAS", name="<name>", include="testclasses")For function groups (on-prem only), expand includes:
SAPRead(type="FUGR", name="<name>", expand_includes=true)For DDLS, CLAS (structured), DCLS, DDLX — the plain source form is sufficient for mirroring; richer structured forms are for reading, not storage.
Catch and continue on per-object errors — log failures in skipped.md with the error class (not-found / forbidden / not-released / connectivity) and move on.
Directory structure:
mirror/<SID>/
README.md ← written in Step 4
system-info.md ← copied or symlinked from bootstrap-system-context
src/
<package_lower>/
zcl_foo.clas.abap
zcl_foo.clas.testclasses.abap
zif_foo.intf.abap
z_report.prog.abap
zi_view.ddls.asddls
zi_view_dcl.dcls.asdcls
zc_view.ddlx.asddlxs
zi_travel.bdef.asbdef
ztable.tabl.xml
zdomain.doma.xml
zdtel.dtel.xml
<subpackage_lower>/
...
skipped.md ← per-object errors and unsupported typesRules:
# Mirror: <SID>
_Generated: <ISO timestamp>_ · _Source: ARC-1_
This directory is a **read-only mirror** of selected ABAP objects from **<SID>**. The SAP system is the source of truth — edits here will NOT be pushed back automatically. To deploy local changes, use `SAPWrite` or a dedicated abapGit export/deploy tool.
See [system-info.md](./system-info.md) for system identity and feature availability.
## Scope
- Mode: <single / list / package>
- <If package: **Package**: ZPKG — recursed into N sub-packages>
- <If list: **Objects**: M explicit>
- Objects mirrored: <count by type>
- Objects skipped: see [skipped.md](./skipped.md)
## Layout
- `src/<package>/` — abapGit-style object files
- `skipped.md` — objects that failed to read or aren't supported yet
## Refreshing
Re-run the `setup-abap-mirror` skill with the same scope. Files are overwritten.Report in 4-6 lines:
5 CLAS, 12 DDLS, 3 BDEF)skipped.md| Error | Cause | Fix |
|---|---|---|
| DEVC read returns 404 | Package does not exist | Ask user to verify the package name via SAPSearch |
| Per-object read fails | Auth / not-released / not-found | Log in skipped.md, continue with the rest |
| Sub-package recursion loops | Circular reference (rare) | Track visited package names; skip duplicates |
FUGR expand_includes fails | On-prem feature, endpoint unavailable | Fall back to expand_includes=false; log as partial |
| Source body empty | Generated proxy or inactive object | Write empty file with a comment header; log in skipped.md |
system-info.md missing | Skill dependency | Run bootstrap-system-context first, then retry |
SAPWrite or a future abapGit deploy action.object.xml convention. That's enough for reading and git diff, not enough for a full abapGit pull-push round trip.SAPRead directlyskipped.md and can be added to ARC-1 over time.This skill produces abapGit-compatible layout today using existing primitives. When ARC-1 gains a dedicated abapGit export action, the internals change but the output directory remains recognizable to any abapGit-aware tool.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.