sap-clean-core-atc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sap-clean-core-atc (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Inventory a package of custom code and bucket every Z/Y object into Clean Core Levels A–D based on the SAP APIs it uses — the "is this cloud-ready?" audit.
This is different from migrate-custom-code: that skill fixes one object's ATC findings; this one produces a package-wide classification report with per-object levels, used to plan a clean-core / BTP migration. It combines ARC-1 (ATC + source access) with mcp-sap-docs (released-API classification data from SAP/abap-atc-cr-cv-s4hc).
| Level | Meaning | Cloud-ready? |
|---|---|---|
| A | Uses only released SAP APIs | ✅ Yes — move as-is to ABAP Cloud / BTP |
| B | Uses classic APIs (on-premise-only, documented) | 🟡 Works on on-prem S/4HANA; needs rewrite for cloud |
| C | Uses internal/stable SAP objects (not customer-released) | 🔴 Supported today but no API guarantee |
| D | Uses objects with no API status (deep internals, undocumented) | 🔴 High migration risk, may break on upgrade |
Source: SAP/abap-atc-cr-cv-s4hc — SAP's official machine-readable release state list.
| Setting | Default | Rationale |
|---|---|---|
| Target system type | public_cloud | Clean-core audits almost always target cloud readiness |
| ATC variant | ABAP_CLOUD_READINESS if available, else system default | Cloud readiness is the point of the exercise |
| Include in scope | Z, Y, plus any /namespace/* the user names | Customer code only; skip SAP-shipped |
| Report detail | Summary table + level-breakdown + top violations | Actionable overview; drill-down on request |
The user provides a package (preferred) or a comma-separated object list, plus optional target system type.
Z_FI_CUSTOM): audit every custom object in itZCL_POSTING, ZR_SALES_REPORT): audit only the named onespublic_cloud (default) | btp | private_cloud | on_premiseIf neither package nor object list is given, ask which to use. Do NOT audit "everything" — that's never what the user wants.
SAPRead(type="DEVC", name="<package>")Filter results to keep only PROG | CLAS | INTF | FUGR | FUNC | DDLS | BDEF | SRVD | TABL with names starting Z, Y, or a customer namespace. Skip subpackages (audit them separately) unless the user says "recursive".
For each name, resolve the type:
SAPSearch(query="<name>")Use the first exact match.
For each custom object, collect the list of SAP-shipped objects it references.
SAPContext(type="<type>", name="<object_name>", depth=1)SAPContext returns a dependency list. Keep only dependencies whose names do NOT start with Z/Y/customer-namespace — those are SAP references. Record each as (objectType, objectName).
SAPContext supports CLAS, INTF, PROG, FUNC, DDLS (on-prem) and CLAS, INTF, DDLS (BTP). For other types (FUGR, BDEF, SRVD, TABL), fall back to reading the source with SAPRead and extracting SAP class / interface / function references with a regex scan over lines (e.g., CL_*, IF_*, SAP*, CALL FUNCTION '...'). Mark these references as "static-scan" in the report so the user knows confidence is lower than AST-derived deps.
SAPDiagnose(action="atc", type="<type>", name="<object_name>", variant="ABAP_CLOUD_READINESS")If ABAP_CLOUD_READINESS doesn't exist on the system, use the system default (omit variant — that runs the system's configured default check variant) and note this in the report. On-premise systems often ship S4HANA_READINESS_<release> (e.g. S4HANA_READINESS_2023) or SAP_CLOUD_PLATFORM_DEFAULT instead of ABAP_CLOUD_READINESS. ATC findings complement the API classification — a released API can still be used incorrectly.
ATC skips `$TMP` / local objects (verified live on S/4HANA 2023). A check run against a$TMPobject resolves to an empty object set and returns zero findings — that's "not checked", not "clean". Package-wide classification only works on transportable packages. If a package is local/$TMP, note in the report that ATC results are unavailable and fall back to the mcp-sap-docs API classification alone. A finding count of 0 on code you expect to be flagged is almost always the$TMPtrap, not clean code.
For each unique SAP object the custom code references:
sap_get_object_details(object_type="<type>", object_name="<name>", system_type="<target>", target_clean_core_level="A")This returns:
cleanCoreLevel — A, B, C, or Dstate — released | deprecated | classicAPI | stable | notToBeReleased | noAPIcomplianceStatus — compliant | non_compliant vs. the target levelsuccessorObjects — replacement recommendations if deprecatedCache results by (object_type, object_name) — the same SAP class is often referenced from many Z-objects.
If an object isn't found in the dataset (found: false), classify as D (unknown / no API) and flag it as requiring manual review.
Each custom object's level is the highest (worst) level among its SAP references:
| If any reference is … | Object level |
|---|---|
| D | D |
| C (and no D) | C |
| B (and no C/D) | B |
| All A | A |
Record per object:
Clean Core Audit — <package_or_list>
Target system: <target> ATC variant: <variant>
Objects audited: 42
Level A: 12 (29%) — ready for ABAP Cloud as-is
Level B: 18 (43%) — on-prem only; rewrite for cloud
Level C: 8 (19%) — uses internal APIs; plan replacement
Level D: 4 (9%) — high risk; manual review requiredFor each level (start with D, work down — worst first):
Level D — High Risk (4 objects)
Object Non-compliant refs Top violation ATC P1
ZCL_MIGRATION_HELPER 8 CL_SALV_TREE_WRAPPER 3
ZR_OLD_POSTING 12 SAPLSMTR_NAVIGATION 5
...For the top 10 most-referenced deprecated APIs, show {deprecated → successor} pairs with counts:
CL_GUI_ALV_GRID (used in 18 Z-objects) → CL_SALV_TABLE (A)
CL_IXML (used in 12 Z-objects) → XML transformations (A)
...Offer next steps:
| Error | Cause | Fix |
|---|---|---|
sap_get_object_details returns found: false | SAP object not in the release state dataset | Classify as D, flag for manual review; dataset covers S/4HANA only |
ABAP_CLOUD_READINESS variant not found | System doesn't have it configured | Fall back to default variant; note in report that finding is less cloud-specific |
| SAPContext unsupported for object type | E.g., dynamic programs, generated code | Fall back to regex scan of source for CL_*, IF_*, SAP* patterns |
| Empty package | Typo or package is only a structure package | Verify via SAPSearch; ask user to pick a child package |
| mcp-sap-docs not connected | Missing MCP server | Skill degrades to ATC-only classification; warn user |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.