development-workflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited development-workflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill enforces disciplined transport management and landscape governance — it makes landscape-breaking shortcuts impossible, not just inadvisable.
| Agent Will Try To... | Why It Seems Reasonable | Why It Fails | Counter |
|---|---|---|---|
| Suggest a direct PRD fix for "urgent" changes | "It's a 2-minute config change, the normal process takes days" | Emergency PRD changes have caused more production incidents than they've prevented. Every "urgent" shortcut bypasses regression checks. | Iron Law 1. Escalate to the emergency transport process (fast-tracked CTS), not a direct PRD change. |
| Mix workbench and customizing in one transport | "These changes are related, keep them together" | Workbench objects need ABAP import; customizing needs business config import. Mixed transports fail on import sequencing across clients. | Iron Law 3. Separate transports are always required. Link them in the change request, not in the transport. |
| Release to PRD without QAS sign-off | "There's no time, we need this in PRD today" | QAS exists to catch exactly the errors that "seem fine" in DEV. Skipping it means the first test is in production with real users. | Iron Law 2. If the process cannot accommodate QAS testing, the process is broken — escalate to management, don't skip QAS. |
| Create objects in the wrong package | "The default package is fine for now" | Objects in wrong packages lose their transport layer assignment. They become orphaned and cannot be moved to the correct landscape via CTS. | Checklist Step 2: Package assignment is mandatory before any object creation. |
| Skip transport documentation | "Everyone knows what this transport does, it's obvious" | In 6 months, "obvious" becomes "what was this for?" Transport audits, rollbacks, and incident investigations all depend on descriptions. | Iron Law 5. No transport gets released without a description referencing the change request. |
| Use local objects ($TMP) for development | "I'll move them to a proper package later" | Local objects cannot be transported. "Later" becomes never. Development ends up in $TMP and can never reach production. | Checklist Step 2: Assign to a transportable package before development begins. |
Watch for these phrases in your own reasoning — each one signals you're about to violate an Iron Law:
<HARD-GATE> Before any development object is created or any transport is opened: confirm (1) the target package exists and is transportable, (2) the development system is DEV — not QAS or PRD, (3) a change request exists in the project tracking system, and (4) the naming convention for this customer/project is confirmed. If any of these four conditions is not met, STOP — do not create the transport. </HARD-GATE>
| Object Type | Transport Type | T-Code to Create | Notes |
|---|---|---|---|
| ABAP programs, function modules, classes | Workbench Request | SE09 | Never mix with customizing |
| IMG/customizing settings | Customizing Request | SE10 | Never mix with workbench |
| Transport of copies | Transport of Copies | SE01 | For corrections only — not standard development flow |
| CTS+ (extended transport) | CTS+ Request | CTS_BROWSER | For non-ABAP content (Fiori, BTP, metadata) |
DEV (Development) → QAS (Quality Assurance) → PRD (Production)
SE09/SE10 STMS Import STMS Import
(develop) (integration test) (change window)Each arrow represents a formal transport import — never a direct change.
Z<CUSTOMER>_<MODULE> — Top-level package (e.g., ZABC_FI)
Z<CUSTOMER>_<MODULE>_OBJ — Dictionary objects (tables, structures, types)
Z<CUSTOMER>_<MODULE>_PRG — Programs and reports
Z<CUSTOMER>_<MODULE>_FC — Function groups and modules
Z<CUSTOMER>_<MODULE>_CL — Classes and interfaces
Z<CUSTOMER>_<MODULE>_ENH — Enhancements and BAdI implementations
Z<CUSTOMER>_<MODULE>_CFG — Configuration (if workbench-transportable)This skill is complete ONLY when ALL of the following are true:
Evidence required: STMS import logs (DEV release + QAS import + PRD import), unit test documentation, QAS test case results with tester sign-off, change request with approval trail.
After completing this skill, invoke: code-review Conditions for handoff: Before the transport is released from DEV (after Step 5, before Step 6), trigger code review to validate the implementation against standards.
code-review before releasing any transport from DEVtroubleshooting if STMS import fails at any landscape stagecode-generation when the development task involves generating new ABAP Cloud or RAP objects~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.