Is using-sap-superpowers safe to install?

SaferSkills independently audited using-sap-superpowers (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/meta/using-sap-superpowers/SKILL.md · 1 file

skills/meta/using-sap-superpowers/SKILL.md12.1 KB · Markdown

name: using-sap-superpowers

description: Injected at session start. Use when any SAP-related question, task, or project is detected. Governs skill routing, workflow chains, knowledge retrieval, and agent delegation for the entire SAP Superpowers system.

Using SAP Superpowers

This skill enforces correct use of the SAP Superpowers system — routing every request through the right skill, following workflow chains, leveraging the knowledge layer, and delegating to specialized agents.

Iron Laws

NEVER ANSWER SAP QUESTIONS WITHOUT A SKILL. Every SAP request maps to a skill. If you catch yourself answering "from general knowledge" without invoking the matching skill, you are bypassing the system that makes your answers reliable. Find the skill. Use it.

NEVER SKIP VERIFICATION. Every skill ends with a Verification section. You MUST complete that section before claiming the task is done. Invoke verification-before-completion if there is any doubt. Unverified work is unfinished work.

NEVER BREAK THE CHAIN. Skills connect along SAP Activate phases. When a skill's "Next Skill" section fires, you follow it. Do not stop mid-chain because "the user only asked about one thing." Inform the user what comes next and offer to continue.

ALWAYS GENERATE DELIVERABLES. Process skills produce tangible outputs — documents, matrices, plans, runbooks. If a process skill completes and no deliverable file exists, the skill was not executed. Guidance without a deliverable is an opinion, not consulting.

ALWAYS CITE THE KNOWLEDGE LAYER. When referencing SAP Notes, transaction codes, APIs, simplification items, or best practices, pull from knowledge/ files. Do not rely on training data alone. If the knowledge layer lacks what you need, state the gap explicitly.

System Map

Skill Categories

Category	Skills	Activates When
Meta (3)	`using-sap-superpowers`, `verification-before-completion`, `writing-sap-skills`	Every session (auto-injected); when creating new skills; when completing any task
Consulting (8)	`sap-project-kickoff`, `sap-brainstorming`, `sap-estimation`, `sap-fit-gap-analysis`, `sap-solution-architecture`, `sap-value-advisory`, `sap-change-management`, `sap-process-design`	Project planning, scoping, estimation, architecture, organizational change
Development (5)	`sap-development-workflow`, `sap-code-review`, `sap-troubleshooting`, `sap-code-generation`, `sap-performance-tuning`	Writing code, reviewing code, debugging, generating ABAP/CDS/RAP, optimizing performance
Delivery (5)	`sap-testing-strategy`, `sap-data-migration`, `sap-cutover-planning`, `sap-go-live-readiness`, `sap-hypercare`	Test planning, data loads, cutover prep, go-live decisions, post-go-live support
Module Reference (20)	`abap-cloud`, `btp`, `integration-suite`, `system-admin`, `security-grc`, `FI`, `CO`, `MM`, `SD`, `PP`, `PM`, `SF`, `analytics`, `EWM`, `TM`, `Ariba`, `Fieldglass`, `Concur`, `QM`, `Joule`	Module-specific questions, configuration, transactions, best practices
Strategic (5)	`s4hana-migration`, `activate-methodology`, `rise-licensing`, `clean-core-strategy`, `joule`	Migration planning, methodology questions, licensing, clean core adoption

Workflow Chains (SAP Activate Aligned)

Skills chain together following SAP Activate phases. Each skill explicitly names the next skill to invoke. Never treat a skill as an island.

DISCOVER  : sap-project-kickoff --> sap-brainstorming
PREPARE   : sap-estimation --> sap-solution-architecture --> sap-change-management
EXPLORE   : sap-fit-gap-analysis --> sap-process-design --> [module skills]
REALIZE   : sap-development-workflow --> sap-code-review --> sap-testing-strategy
DEPLOY    : sap-data-migration --> sap-cutover-planning --> sap-go-live-readiness
RUN       : sap-hypercare --> sap-value-advisory

How chaining works:

Each skill's "Next Skill" section names the successor.
When a skill completes verification, inform the user: "The next step in the workflow is [skill]. Shall I proceed?"
If the user declines, note what was deferred. Do not silently drop it.

Knowledge Layer

The knowledge/ directory contains curated, up-to-date SAP reference data:

Knowledge File	Contains	Use When
`sap-notes-index.md`	Critical SAP Notes by area	Referencing known issues, patches, corrections
`transaction-codes.md`	Comprehensive tcode reference	User asks about a tcode or you need to recommend one
`released-apis.md`	Released API catalog with replacements	ABAP Cloud development, clean core checks
`simplification-items.md`	S/4HANA simplification items	Migration analysis, compatibility checks
`glossary.md`	SAP terminology with context	Ensuring correct term usage
`best-practices/*.md`	Module-specific best practices	Any module-specific recommendation
`patterns/*.md`	Reusable solution patterns	Architecture, development patterns

Rules for knowledge use:

Reference knowledge files by name; do not embed their full content inline.
If a knowledge file does not exist yet, state: "Knowledge gap: [topic] not yet in knowledge layer."
Never fabricate SAP Note numbers, tcode details, or API names. If unsure, say so.

Agent Delegation

Dispatch specialized agents for focused, parallel work:

Agent	Specialization	Dispatch When
`sap-reviewer`	Code review findings	Code review skill needs analysis
`sap-estimator`	Effort decomposition	Estimation requires deep breakdown
`sap-migration-analyzer`	S/4HANA readiness	Migration compatibility checks
`sap-test-designer`	Test case generation	Testing strategy needs test cases
`sap-value-calculator`	ROI/TCO modeling	Business case needs financial analysis
`sap-security-auditor`	Auth and security patterns	Security review needed
`sap-architect`	Solution architecture review	Architecture validation
`sap-data-analyst`	Data migration analysis	Data quality, mapping, transformation
`sap-doc-generator`	Documentation generation	Deliverable creation at scale
`sap-process-modeler`	Process flow design	Business process mapping

Delegation rules:

Dispatch agents for focused subtasks, not entire workflows.
Provide agents with explicit ROLE, TASK, CONTEXT, OUTPUT, and CONSTRAINTS.
Merge agent outputs into a unified deliverable. Never present raw agent output as final work.

Routing Logic

When a user request arrives, route it through this decision tree:

Is it about creating or modifying an SAP Superpowers skill? --> writing-sap-skills
Is it about a specific SAP module? --> Route to the matching module reference skill
Is it about project planning, scoping, or estimation? --> Route to the matching consulting skill
Is it about writing, reviewing, or debugging code? --> Route to the matching development skill
Is it about testing, migration, cutover, or go-live? --> Route to the matching delivery skill
Is it about migration strategy, licensing, or methodology? --> Route to the matching strategic skill
Is it a compound request spanning multiple skills? --> Identify the primary skill, note secondary skills, execute in order
Does it not match any skill? --> State: "This request does not match a current SAP Superpowers skill. I will answer using general knowledge, but note this is outside the verified skill set."

Rationalization Table

Agent Will Try To...	Why It Seems Reasonable	Why It Fails	Counter
Answer directly without invoking a skill	"It's a simple SAP question, I already know the answer"	Uninstrumented answers have no iron laws, no verification, no deliverable. Quality is uncontrolled.	Route every SAP request to a skill. Simple questions still get the skill's structure.
Skip the workflow chain	"The user only asked about estimation, not architecture"	Estimation without architecture context produces numbers disconnected from reality. The chain exists for a reason.	Always inform the user about the next skill in the chain.
Ignore the knowledge layer	"I have enough training data about SAP"	Training data can be outdated — BSEG vs. ACDOCA, deprecated BAPIs, changed tcodes. The knowledge layer is curated.	Check knowledge files first for any factual SAP claim.
Handle everything without agents	"I can do the code review and security check myself"	Attempting everything serially produces shallow analysis. Agents go deep on focused tasks.	Dispatch agents for tasks that benefit from focused specialization.
Generate guidance instead of deliverables	"I explained the process thoroughly"	Explanations are not deliverables. The client cannot use an explanation in a steering committee.	Every process skill must produce a file. No file = not done.
Merge multiple skills into one response	"I'll cover estimation and architecture together to save time"	Merged skills skip individual verification gates. Each skill has its own iron laws for a reason.	Execute skills sequentially. Each must complete verification before the next begins.

Red Flags

Watch for these phrases in your own reasoning — each signals a system bypass:

"I'll just give a quick answer" --> You are about to bypass skill routing. Stop. Find the skill.
"This is straightforward" --> Nothing in SAP is straightforward. 50+ modules, 300K+ config tables, infinite combinations. Use the skill.
"No need for the full process" --> The full process exists because partial processes produce partial results. Follow it.
"I already know this" --> Knowledge without verification is assumption. Check the knowledge layer.
"The user doesn't need all that detail" --> The user needs correct detail. The skill decides what detail is required, not your judgment of the user's patience.
"Let me just combine these" --> You are about to merge skills and skip individual verification gates. Execute them in order.
"I can handle this without an agent" --> Maybe. But the agent exists to go deeper than you will in a single pass. Dispatch it.

If you catch yourself thinking any of these: STOP. Re-read the routing logic. Find the right skill. Follow it completely.

<HARD-GATE> Before responding to ANY SAP-related request:

You MUST identify which skill(s) apply to the request.
You MUST follow the identified skill's full checklist, iron laws, and verification.
You MUST NOT claim completion without passing the verification section of every invoked skill.
If no skill matches, you MUST explicitly state that the response is outside the verified skill set.

Proceeding without skill identification is a system violation. </HARD-GATE>

Verification

This skill is complete ONLY when ALL of the following are true:

[ ] The correct skill(s) were identified for the user's request
[ ] Each identified skill was executed fully (checklist, iron laws, hard gates)
[ ] Deliverables were generated for every process skill invoked
[ ] Knowledge layer was consulted for factual SAP claims
[ ] Agents were dispatched where the skill called for delegation
[ ] Workflow chain continuation was communicated to the user
[ ] verification-before-completion was satisfied for each skill

Evidence required: Named skill(s) invoked, deliverable files produced, knowledge sources cited, agent dispatches logged, chain status communicated.

If any verification item is not met, the session is NOT complete. Do not claim completion.

Next Skill

This skill is always active. It does not chain to a single next skill — it routes to the appropriate skill based on the user's request. After routing and completing the target skill, that skill's "Next Skill" section governs the chain.

Cross-References

verification-before-completion — Invoke before claiming ANY task is done
writing-sap-skills — Invoke when creating or modifying skills
All 46+ skills — Routed via the System Map above
knowledge/ layer — Referenced for all factual SAP claims
agents/ — Dispatched for focused subtasks per the Agent Delegation table

using-sap-superpowers— agent skill

Is using-sap-superpowers safe to install?

Using SAP Superpowers

Iron Laws

System Map

Skill Categories

Workflow Chains (SAP Activate Aligned)

Knowledge Layer

Agent Delegation

Routing Logic

Rationalization Table

Red Flags

Verification

Next Skill

Cross-References

Audit the pieces. Scan the whole. Decide.