atc-cloudification — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited atc-cloudification (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Configure ABAP Test Cockpit (ATC) clean core checks against the SAP Cloudification Repository, and map findings to clean core levels (A, B, C, D) for governance and remediation planning.
The clean core level concept supersedes the former 3-tier extensibility model. ATC is the governance tool that makes levels measurable: priority 1 → Level D, priority 2 → Level C, priority 3 → Level B, no finding → Level A.
The SAP Cloudification Repository contains the release state and clean core classification of SAP objects. Its JSON files serve as ATC check content, enabling customers and partners to analyse custom code across all ECC and S/4HANA releases.
Read references/quick-reference.md for:
https://raw.githubusercontent.com/SAP/abap-atc-cr-cv-s4hc/main/src/objectReleaseInfoLatest.jsonhttps://raw.githubusercontent.com/SAP/abap-atc-cr-cv-s4hc/main/src/objectReleaseInfo_PCELatest.jsonPCELatest with the version, e.g. PCE2025_0 for Release 2025 FPS00For the newer ATC checks "Usage of APIs" and "Allowed Enhancement Technologies", use:
https://raw.githubusercontent.com/SAP/abap-atc-cr-cv-s4hc/main/src/objectClassifications_SAP.jsonExtensions are classified into clean core levels (A–D) based on the SAP objects they consume. An extension takes the lowest level of any object it uses.
The clean core level concept supersedes the former 3-tier extensibility model.
| Clean Core Level | SAP object qualifier | Meaning | ATC finding |
|---|---|---|---|
| Level A | [Released] remote API, local API, extension point | Governed by a formal stability contract. Target state for all new development. | No finding |
| Level B | [Classic] SAP API, SAP extension point | SAP-nominated classic APIs and frameworks. No stability contract, but proven upgrade-stable. | Priority 3 (information) |
| Level C | [Internal] SAP object | The default for any object not otherwise classified. Not released, not documented, not supported. | Priority 2 (warning) |
| Level D | [Not recommended] SAP object, extension point or technology | Explicitly unfit for customer use. Highest risk and technical debt. | Priority 1 (error) |
Clean core status: Level A = clean core · Levels B and C = conditional clean core · Level D = not clean core.
noAPI objects, modifications, implicit/explicit enhancements, direct table writes, form routine calls, and critical ABAP statements.objectReleaseInfo*.json — release state of SAP objects: released, deprecated, notToBeReleased, notReleasedobjectClassifications_SAP.json — clean core classification: classicAPI (Level B), noAPI (Level D), internalAPI (Level C with a released successor available)remote-enabled (RFC-enabled), transactional-consistent (usable inside RAP-based applications)Classified object types: FUNC (function modules), CLAS (classes), INTF (interfaces), STOB (CDS views), BDEF (BO interfaces).
DDIC objects (data elements, structures, table types) are not classified and are not checked when used as data types. Only SQL access to SAP tables is checked.
Configure a single global check variant used during development and on transport release. Set ATC transport settings so priority 1 and 2 findings block release.
| Check | Category | Technical name | Purpose |
|---|---|---|---|
| Usage of APIs | Clean core | SYCM_USAGE_OF_APIS | Released/classic API classification, SQL on SAP tables and views, calls to SAP form routines |
| Allowed enhancement technologies | Clean core | SYCM_ALLOWED_ENH_TECHNOLOGY | Reports ENHO enhancements on non-allowed technology. Only BAdIs are recommended. |
| Search customer modifications | Clean core | CI_SEARCH_CUST_MODIFICATIONS | Finds modified objects (one finding per object); checks ABAP Cloud object type support |
| Critical statements | Clean core | CI_CRITICAL_STATEMENTS | Statements critical for security or program stability (kernel calls, EXEC SQL, …) |
| Code Vulnerability Analyzer | Additionally recommended | SLIN_SEC | Security vulnerabilities |
If Usage of APIs or Allowed Enhancement Technologies is missing, implement SAP Note 3565942.
ABAP_CLEAN_CORE_DEVELOPMENT — SAP-delivered predefined variant for initial setupABAP_CLOUD_DEVELOPMENT_DEFAULT — template to enrich with the checks aboveABAP_CLOUD_READINESS — verify ABAP Cloud rules before switching an object's language versionSet up a central ATC system for the whole landscape:
| ATC priority | Level | Finding | Recommended action |
|---|---|---|---|
| Priority 1 (Error) | D | Object is modified | Remove modification; use a BAdI instead |
| Enhancement technology is not allowed | Delete enhancement implementation; use a BAdI | ||
| Implicit or explicit enhancement (source code plug-in) | Delete enhancement implementation; use a BAdI | ||
| Direct write access to SAP database tables | Use released or classic APIs | ||
| Call of form routines in SAP program | Use released or classic APIs | ||
Usage of SAP object classified as noAPI | Use released or classic APIs; use successor info | ||
| Usage of critical ABAP statements | Use released or classic APIs | ||
| Priority 2 (Warning) | C | Direct read access to SAP database table/view | Use released CDS view or classic API |
| Usage of SAP object not classified as classic API (internal) and not released | Use released or classic APIs | ||
| Priority 3 (Info) | B | Usage of deprecated APIs | Use the successor instead |
| Usage of classic APIs | — acceptable, no action required |
CI_CRITICAL_STATEMENTS reports: kernel function calls · system-calls · editor calls · EXEC SQL · database hints · generation of reports and Dynpros · read/insert report · read/insert Dynpro · import/export nametab.
Internal SAP objects can change during an upgrade, feature pack import, or even an SAP Note import. The changelog proactively lists objects with incompatible changes in upcoming releases.
Incompatible changes include: deletion of objects · renaming or deletion of function module parameters · incompatible parameter type changes · renaming or deletion of methods in SAP classes · removal of fields from CDS views.
Covered object types: FUNC, CLAS, INTF, STOB, BDEF.
Setup:
SYCMObjects in the changelog are not automatically demoted to Level D — continued usage may be allowed depending on the change's criticality. Use findings to drive refactoring toward released or classic APIs.
SYCM for Level C risk assessmentWhen helping with ATC clean core topics, structure responses as:
## ATC Clean Core Guidance
### Configuration
- Target product: [SAP Cloud ERP / SAP Cloud ERP Private]
- JSON file: [URL]
- Check variant: [name and included checks]
### Finding Classification
| ATC finding | Priority | Clean core level | Action |
|-------------|----------|------------------|--------|
| ... | ... | ... | ... |
### Remediation Plan
[Ordered: Level D first, then C, then B]
### Exemption Recommendations
[Which findings justify an exemption and why]Use the online viewers to browse object classifications interactively:
noAPI / internalAPI): https://sap.github.io/abap-atc-cr-cv-s4hc/?version=objectClassifications_SAP.jsonFilter by state:
classicAPI → Level B candidatesinternalAPI → Level C with a released successor availablenoAPI → Level D, must be replacedSYCM_USAGE_OF_APIS and SYCM_ALLOWED_ENH_TECHNOLOGY~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.