abap-cloud — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited abap-cloud (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Enforces clean-core compliance: every piece of ABAP Cloud code MUST use only released APIs, restricted syntax, and RAP patterns — no exceptions.
| Topic | Section |
|---|---|
| Released API verification | Iron Laws + Released API Patterns |
| RAP development | RAP Overview |
| CDS views | CDS View Patterns |
| Syntax restrictions | Restricted Syntax Reference |
| Service exposure | Service Binding Patterns |
@ReleaseState: RELEASED, it CANNOT be used. Using unreleased APIs breaks upgrades — your code will fail silently in the next release.ABAPDOC or check the object in ADT "Released Objects" view before referencing any SAP object. Checking after writing is too late — rewrites are expensive.SELECT * INTO TABLE without field list, EXEC SQL, CALL FUNCTION (use CALL METHOD of a released function group), direct table access to DDIC tables without CDS. Restricted syntax is not a suggestion.MODIFY ENTITY). Direct DML breaks the framework's consistency model.| Agent Will Try To... | Why It Seems Reasonable | Why It Fails | Counter |
|---|---|---|---|
| Use a classic BAPI directly | "BAPIs are stable SAP interfaces" | Most BAPIs are not released for ABAP Cloud; they will be blocked at activation | Check BAPI release status in SE37 → "Where-Used" → Cloud Release state before any BAPI reference |
Access MARA, BKPF, EKKO directly | "These are standard SAP tables, always available" | Direct table access is forbidden in Cloud; use released CDS views (e.g., I_MaterialDocumentItem) | Replace with the corresponding released CDS VDM view; see SAP API Business Hub for equivalents |
| Skip ATC because "it's just a small change" | "ATC takes time, it's a minor fix" | A one-line change using a non-released type fails upgrade validation. All changes require ATC. | Iron Law 5: ATC is always required. No exceptions for size. |
| Use CALL FUNCTION for utility logic | "Function modules work fine in on-prem" | Classic function module calls are restricted in Cloud; use class-based calls or released APIs | Refactor to ABAP OO; use released utility classes from CL_* namespace |
| Write SQL without CDS views | "OpenSQL still works" | Direct table SELECT bypasses authorizations built into CDS; creates maintenance debt | Define a CDS view with @AccessControl.authorizationCheck: #CHECK and query through it |
Watch for these in your own reasoning — each signals an Iron Law violation:
I_JournalEntry CDS.<HARD-GATE> Before writing any ABAP Cloud code: confirm the target system (BTP ABAP Environment / S/4HANA Public Cloud / Private Cloud). Confirm all referenced SAP objects appear in ADT Released Objects browser or SAP API Business Hub with status RELEASED. Do not write a single line of code until these confirmations exist. </HARD-GATE>
I_ (interface), C_ (consumption), P_ (private)..bdef), behavior implementation (class), service definition, service binding.READ ENTITY, MODIFY ENTITY, COMMIT WORK AND WAIT.| Tool | Purpose |
|---|---|
| ADT (Eclipse) | Primary dev environment for Cloud |
ABAPDOC | Released API documentation |
| ATC (ABAP Test Cockpit) | Code quality + Cloud readiness |
SE80 | Not available in Cloud — use ADT |
SEGW | OData v2 service — prefer RAP for new dev |
/IWFND/MAINT_SERVICE | Activate OData services (classic) |
| Domain | Released CDS View |
|---|---|
| Journal entries | I_JournalEntry, I_JournalEntryItem |
| Material documents | I_MaterialDocumentItem |
| Purchase orders | I_PurchaseOrder, I_PurchaseOrderItem |
| Sales orders | I_SalesOrder, I_SalesOrderItem |
| Business partner | I_BusinessPartner |
| Cost center | I_CostCenter |
| Profit center | I_ProfitCenter |
@AbapCatalog.viewEnhancementCategory, add define root view entitymanaged or unmanaged; declare operations (create, update, delete, actions, determinations, validations)FAILED, REPORTED structures; report to field levelRAISE ENTITY EVENT; consume via Event Consumption Modelcl_http_client (released) or Destination Service; never hard-code URLssideEffects in behavior definition to trigger UI refreshThis skill is complete ONLY when ALL of the following are true:
Evidence required: ATC results screenshot / export showing clean run; service binding URL confirmed active.
After completing ABAP Cloud development, invoke: verification-before-completion For deployment to BTP, invoke: btp For API exposure and management, invoke: integration-suite
btp — BTP environment setup, CAP, HANA Cloudintegration-suite — Exposing and consuming APIscode-review — General code quality reviewtroubleshooting — Debugging runtime errorsFull travel entity showing CDS → Behavior → Service → Binding:
* 1. CDS Interface View
define root view entity ZI_Travel
as select from /dmo/travel as travel
{
key travel_id as TravelID,
agency_id as AgencyID,
customer_id as CustomerID,
begin_date as BeginDate,
end_date as EndDate,
booking_fee as BookingFee,
total_price as TotalPrice,
currency_code as CurrencyCode,
status as Status
}
* 2. CDS Projection View
@AccessControl.authorizationCheck: #CHECK
define root view entity ZC_Travel
provider contract transactional_query
as projection on ZI_Travel
{
key TravelID,
AgencyID,
CustomerID,
BeginDate,
EndDate,
BookingFee,
TotalPrice,
CurrencyCode,
Status
}
* 3. Behavior Definition
managed implementation in class zbp_i_travel unique;
strict ( 2 );
define behavior for ZI_Travel alias Travel
persistent table /dmo/travel
lock master
etag master LastChangedAt
{
create;
update;
delete;
field ( readonly ) TravelID, Status;
validation validateDates on save { create; field BeginDate, EndDate; }
action acceptTravel result [1] $self;
determination calculateTotalPrice on save { create; update; }
}
* 4. Service Definition
define service ZUI_TravelService {
expose ZC_Travel as Travel;
}
* 5. Service Binding: OData V4 UI* Read
READ ENTITIES OF ZI_Travel
ENTITY Travel FIELDS ( TravelID BeginDate )
WITH VALUE #( ( TravelID = '001' ) )
RESULT DATA(lt_travel)
FAILED DATA(ls_failed)
REPORTED DATA(ls_reported).
* Modify
MODIFY ENTITIES OF ZI_Travel
ENTITY Travel
UPDATE FIELDS ( Status )
WITH VALUE #( ( TravelID = '001' Status = 'A' ) )
FAILED ls_failed
REPORTED ls_reported.
* Execute Action
MODIFY ENTITIES OF ZI_Travel
ENTITY Travel EXECUTE acceptTravel
FROM VALUE #( ( TravelID = '001' ) )
RESULT DATA(lt_result).| Allowed (Cloud) | Forbidden (Cloud) | Why |
|---|---|---|
SELECT FROM ZC_Travel | SELECT FROM /dmo/travel | Must use CDS/released view |
cl_abap_context_info=>get_user_technical_name( ) | SY-UNAME | Context abstraction required |
| Field symbols with structures | EXEC SQL | Native SQL not allowed |
VALUE #(...), inline declarations | COMPUTE, obsolete statements | Modern ABAP only |
| Released Function Modules only | Unreleased FMs | API release state check |
Released classes (cl_abap_*) | Internal classes | Upgrade safety |
SELECT * FROM I_APIBusinessObject WHERE ReleaseState = 'RELEASED'@ObjectModel.api annotation visible in CDS sourceC0 contract); verify state~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.