Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/boxlogodev/sapstack/sap-cbo-explaingit clone --depth 1 https://github.com/BoxLogoDev/sapstackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00071 | $0.00499 |
| Opus 5 | $0.00036 | $0.00249 |
| Sonnet 5 | $0.00014 | $0.00100 |
| Haiku 4.5 | $0.00007 | $0.00050 |
Grade A, and why
sap-cbo-explain scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
CBO 설명 (현업용)
대상: $ARGUMENTS
실행 순서
-
스냅샷 확인
- 기본 위치
~/.sapstack/cbo/*/manifest.yaml을 Glob으로 탐색 - 없으면: "CBO 스냅샷이 없습니다 — 관리자에게
npm run cbo:export실행을 요청하세요 (docs/cbo-snapshot.md)" 안내 후 종료 - manifest에서 SID·기준일 확보 (답변에 반드시 포함)
- 기본 위치
-
대상 결정
- 인수가 파일 경로면 그대로 사용
- 인수가 오브젝트명(Z*/Y*/SAPMZ* 등)이면
catalog.json에서name검색 →file경로 확보 - 인수가 증상 문장("저장할 때 오류")이면 catalog.md의 설명 열과
src/**MESSAGE 리터럴 Grep으로 후보 압축 - catalog에 없으면 "스냅샷에 없습니다" 로 종료 (추측 금지)
-
sap-cbo-explainer 서브에이전트에 위임
- Task 도구로
sap-cbo-explainer호출 - 전달: 스냅샷 루트 경로, 대상 파일 목록, manifest 기준일, 원 질문
- 출력 계약(한 줄 요약/어디서 쓰나/처리 흐름/주의할 점/기준 시점) 준수 확인
- Task 도구로
주의
- 이 커맨드는 설명 전용 — 코드 리뷰는
/sap-abap-review, 수정 제안은 담당 개발자 확인 필요 - 장애 진단으로 확장되면
/sap-session-start(Evidence Loop)로 전환하고, 코드 근거는kind: custom_note+tags: [cbo-snapshot, <오브젝트>]로 첨부
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 32 lines · 71 tokens per session scan A 988215eb4d8d
sap-cbo-explain is a command published in the GitHub repository BoxLogoDev/sapstack (18 stars, last pushed 2d ago), licensed MIT. It adds 71 tokens to every session and 499 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
eval-author
Draft a new eval case (eval/cases/ .json) + scaffold its golden folder, goldenpending until captured on the VM.
eval-improve
Work the eval-loop corpus — rank failure clusters, fix the top actionable defect, validate against held-out, open a PR.
eval-run
Run an eval case end-to-end on the VM (implement → build → score → record → roll back). VM/full-mode only.
research-l2
Executes Phases 1-3 of the L2 process of the abapwiki knowledge base on a slice: launches the abap-functional-researcher sub-agent (gap discovery + multi-source auto-research: wiki -> raw/docs -> MCP abap-fs on the system read-only -> standard knowledge), ingests gaps and evidence, and generates questionnaires for…
ingest-l0
L0 bootstrap of the abapwiki knowledge base: creates stubs for all custom objects from the TADIR. Use this skill to initialize the repo from scratch or to ingest a new TADIR export. Deterministic operations (no LLM sub-agent), idempotent.
ingest-l1
L1 analysis loop for the abapwiki knowledge base: for each batch it launches the abap-analyzer sub-agent in parallel, then the adversarial judge abap-deepcheck (separate session), applies only the analyses that pass the fail-closed gate, and commits. Resumes exactly after an interruption. Use this skill to document…