Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add arc-mcp/arc-1 --skill setup-abap-mirrorgit clone --depth 1 https://github.com/arc-mcp/arc-1Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arc-mcp/arc-1/setup-abap-mirror)<a href="https://agentmods.dev/skills/arc-mcp/arc-1/setup-abap-mirror"><img src="https://agentmods.dev/badge/skills/arc-mcp/arc-1/setup-abap-mirror.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 137 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.02297 |
| Opus 5 | $0.00037 | $0.01149 |
| Sonnet 5 | $0.00015 | $0.00459 |
| Haiku 4.5 | $0.00007 | $0.00230 |
Grade A, and why
setup-abap-mirror scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 216 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Setup ABAP Mirror
Create a local abapGit-style mirror of an SAP package or object set. Reads are authoritative from the SAP system; local files give you IDE context, git diff, and fast searching without round-tripping every time.
This skill works today with ARC-1's existing SAPRead + DEVC primitives. When dedicated abapGit export tooling lands in ARC-1, the skill can be simplified — the file layout it produces is the target format either way.
Smart Defaults (apply silently, do NOT ask)
| Setting | Default | Rationale |
|---|---|---|
| Mirror root | ./mirror/<SID>/src/<package>/ |
Groups by system to support multi-system work |
| File naming | abapGit conventions | Standard; future-proof |
| Recurse sub-packages | Yes | Matches abapGit behaviour |
| Include test classes | Yes | Tests belong with the class |
| Include metadata XML | Skip for now | ARC-1 does not yet emit abapGit-format XML; source-only is useful and safe |
Input
One of the following scopes:
- Single object —
name+type(e.g.,ZCL_TRAVEL_HANDLER,CLAS) - Object list — array of
{ type, name }pairs - Package —
packagename; pulls everything inside
Optionally:
- Mirror root (default:
./mirror/<SID>/src/<package>/) - Skip test classes (default: include them)
Prerequisites
Before running, ensure system-info.md exists. If it doesn't:
→ Run the bootstrap-system-context skill first
The mirror header references SID, system type, and release from system-info.md.
Step 1: Resolve Scope Into An Object List
1a. For a package scope
SAPRead(type="DEVC", name="<PACKAGE>")
Returns [{ type, name, description, uri }, ...] where type is slash-form (CLAS/OC, DDLS/DF, PROG/P, DEVC/K, etc.).
For each DEVC/K entry (sub-package): recurse — call SAPRead(type="DEVC", name=<sub>) and append its contents.
Normalize slash-form types to the ARC-1 SAPRead short codes:
| Slash form | SAPRead type | abapGit extension |
|---|---|---|
CLAS/OC |
CLAS |
.clas.abap (+ .clas.testclasses.abap) |
INTF/OI |
INTF |
.intf.abap |
PROG/P |
PROG |
.prog.abap |
FUGR/F |
FUGR |
.fugr.abap (expanded includes) |
FUNC/FF |
FUNC |
.func.abap |
DDLS/DF |
DDLS |
.ddls.asddls |
DCLS/DL |
DCLS |
.dcls.asdcls |
DDLX/EX |
DDLX |
.ddlx.asddlxs |
BDEF/BO |
BDEF |
.bdef.asbdef |
SRVD/SRV |
SRVD |
.srvd.asrvd |
SRVB/SVB |
SRVB |
.srvb.xml |
TABL/DT |
TABL |
.tabl.xml |
STRU/DS |
STRU |
.stru.xml |
DOMA/DD |
DOMA |
.doma.xml |
DTEL/DE |
DTEL |
.dtel.xml |
MSAG/N |
MSAG |
.msag.xml |
ENHO/EO |
ENHO |
.enho.xml |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 216 lines · 75 tokens per session scan A 923882d57057
setup-abap-mirror is a skill published in the GitHub repository arc-mcp/arc-1 (182 stars, last pushed today), licensed MIT. It adds 75 tokens to every session and 2,297 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
prowler-commit
Creates professional git commits following conventional-commits format. Trigger: When creating commits, after completing code changes, when user asks to commit.
gh-auth-isolation
Safely manage multiple GitHub identities (EMU + personal) in agent workflows.
comet-github
A routing guide for Comet-related GitHub work. It directs requests about pull requests, issues, CI failures, ideas, and fixes to the appropriate review or implementation process.
github-skill
Work with GitHub via the gh CLI — clone repositories, create/list/merge pull requests, create/list issues, and run any other gh command (API calls, workflow runs, releases, repo administration). List operations return parsed JSON.
re0-merge
Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…
codex-autoresearch
Run autonomous, measurable experiments in a Git repository: change one hypothesis, verify a numeric metric, keep improvements, and revert failures. Use when the user wants Codex to keep iterating toward a numeric target in the foreground or as a detached background run. Do not use for ordinary one-shot coding…