program-to-spec — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited program-to-spec (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill reads existing ABAP code and produces a structured specification document — either a Functional Specification (what it does from a business perspective) or a Technical Specification (how it works from a developer perspective). The output is client-ready, not a code comment dump.
| Agent Will Try To... | Why It Seems Reasonable | Why It Fails | Counter |
|---|---|---|---|
| Describe code instead of business logic | "The code IS the specification" | Code is implementation, not specification. Specs describe WHAT and WHY. Code describes HOW. | Iron Law 1. Translate code into business terms. |
| Skip dead code analysis | "Dead code doesn't matter" | Dead code in SAP is often conditionally active (different plants, company codes, or periods). Document it. | Analyze all code paths. Flag potentially dead code as "Conditional — verify activation criteria." |
| Invent business reasons for hardcoded values | "This must be for tax calculation" | Guessing business logic from hardcoded values is how wrong specs get written. | Iron Law 5. Document as: "Hardcoded value [X] — business justification needed." |
| Produce one combined document | "One document is simpler" | Business users won't read technical details. Developers don't need business context. | Iron Law 4. Two separate docs. |
<HARD-GATE> Before producing the specification:
If the code cannot be fully read (missing includes, broken references), document the gaps explicitly. </HARD-GATE>
Read the complete program and produce an inventory:
Map the code logic to business process steps:
Document how data moves through the program:
# Functional Specification: [Program Name]
## Overview
**Program:** [Technical name]
**Business Process:** [Process name]
**Module:** [SAP module]
**Purpose:** [1-2 sentence business description]
## Business Context
[Why this program exists, what business need it serves]
## Scope
### In Scope
- [Business function 1]
- [Business function 2]
### Out of Scope
- [Explicitly excluded functions]
## Process Flow
1. [Business step 1] — [What happens]
2. [Business step 2] — [What happens]
3. ...
## Business Rules
| Rule | Description | Implementation |
|------|-------------|----------------|
| BR-01 | [Rule description] | [How it's enforced] |
## Input/Output
### Inputs
| Input | Source | Format | Validation |
|-------|--------|--------|------------|
### Outputs
| Output | Destination | Format | Trigger |
|--------|------------|--------|---------|
## Authorization
| Auth Object | Field | Values | Business Role |
|-------------|-------|--------|--------------|
## Assumptions & Gaps
| # | Item | Type | Status |
|---|------|------|--------|
| 1 | [Item] | Assumption/Gap | Needs clarification |# Technical Specification: [Program Name]
## Technical Overview
**Program:** [Name] | **Type:** [Report/Module Pool/Class]
**Package:** [Package] | **Transport:** [If known]
**ABAP Release:** [Minimum required]
## Architecture
[Class diagram or structure overview]
## Object Inventory
| Object | Type | Purpose |
|--------|------|---------|
| [Name] | Class/FM/Include | [Purpose] |
## Data Model
### Tables/Views Accessed
| Table/CDS | Access Type | Purpose |
|-----------|------------|---------|
### Internal Data Structures
| Structure | Fields | Purpose |
|-----------|--------|---------|
## Method/Function Documentation
### [Method Name]
- **Purpose:** [What it does]
- **Parameters:** [In/Out/Changing/Returning]
- **Exceptions:** [What can go wrong]
- **Dependencies:** [What it calls]
## External Interfaces
| Interface | Type | Direction | System |
|-----------|------|-----------|--------|
## Error Handling
| Error | Handler | User Message | Recovery |
|-------|---------|-------------|----------|
## Performance Considerations
- [Known performance patterns — indexed access, buffering, parallel processing]
## Technical Gaps
| # | Item | Impact | Recommendation |
|---|------|--------|---------------|After completing this skill, invoke: code-review (if the reverse-engineered code needs quality assessment) Or: s4hana-migration (if the spec is being produced for migration analysis)
code-review — Review the code quality during reverse engineerings4hana-migration — Use spec output for migration compatibility analysissolution-architecture — Use spec output for architecture documentation~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.