Azure/sap-automation-bootstrap is a customer-configuration and wrapper-pipeline repository for running the SAP Deployment Automation Framework through Azure DevOps. It stores deployment settings and invokes implementation templates from the separate sap-automation repository. Its catalogue skills and plugin help coding agents bootstrap Azure DevOps projects and explain the available wrapper pipelines.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Azure/sap-automation-bootstrap --skill sdaf-ado-project-bootstrapgit clone --depth 1 https://github.com/Azure/sap-automation-bootstrapWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/azure/sap-automation-bootstrap/sdaf-ado-project-bootstrap)<a href="https://agentmods.dev/skills/azure/sap-automation-bootstrap/sdaf-ado-project-bootstrap"><img src="https://agentmods.dev/badge/skills/azure/sap-automation-bootstrap/sdaf-ado-project-bootstrap/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/azure/sap-automation-bootstrap/sdaf-ado-project-bootstrap"><img src="https://agentmods.dev/badge/skills/azure/sap-automation-bootstrap/sdaf-ado-project-bootstrap.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00218 | $0.01893 |
| Opus 5 | $0.00109 | $0.00946 |
| Sonnet 5 | $0.00044 | $0.00379 |
| Haiku 4.5 | $0.00022 | $0.00189 |
Grade A, and why
sdaf-ado-project-bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SDAF — Azure DevOps project bootstrap and workload-zone onboarding
Drives the two documented PowerShell utilities that create the SDAF Azure
DevOps footprint: New-SDAFADOProject (project + control-plane artifacts) and
New-SDAFADOWorkloadZone (variable group + service connection for each extra
workload environment). Same script family, same doc pages, one operator sitting. Documented in
docs/02-00-bootstrap.md,
docs/02-10-configure-devops-project.md,
and docs/02-20-configure-workload-zone-artifacts.md.
When to invoke
Trigger utterances: "set up SDAF on Azure DevOps", "bootstrap the Azure DevOps project", "create the SDAF-MGMT-SECE project", "add / onboard the TEST-SECE-SAP01 workload zone", "create the SDAF- variable group and workload service connection".
Do not invoke for: "what does pipeline 01 do?" or "which variable group
does 05 read?" (→ sdaf-ado-pipeline-catalogue); anything on the GitHub
Actions surface; or actually deploying the control plane, workload zone, or
SAP system (bootstrap creates artefacts; deployment is a separate hub-plugin
skill).
Recipe
Both journeys run from Windows PowerShell with the latest Azure CLI, download
SDAFUtilities.psm1 from the reviewed sap-automation ref, sign in, run the
utility, capture returned values.
A. First-time project bootstrap
- Confirm inputs listed at the top of
docs/02-10-configure-devops-project.md(see alsodocs/01-00-prerequisites.md): Azure DevOps organization URL, tenant ID, control-plane subscription ID, control-plane and region codes, agent-pool name, SAP support credentials, reviewedsap-automationbranch,SDAF-MSIsresource group. - Copy the script in
docs/02-10-configure-devops-project.md § Configure the scriptinto a local.ps1. Replace every placeholder. Drop-EnableWebAppwhen the configuration Web App is not in scope. az upgrade, sign in to the intended Azure tenant, then run the.ps1; complete each browser prompt the utilities open.- Wait for
New-SDAFADOProjectto finish. Record the project URL, the managed-identity ID fromNew-SDAFUserAssignedIdentity, and the agent-pool name.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 136 lines · 218 tokens per session scan A cdbcc7d797a5
sdaf-ado-project-bootstrap is a skill published in the GitHub repository Azure/sap-automation-bootstrap (11 stars, last pushed 13d ago), licensed MIT. It adds 218 tokens to every session and 1,893 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
atmos-hooks
Atmos hooks: lifecycle events, hook kinds, command/store/git/security hooks, step/steps hooks, when: conditions, scoping and overrides, toolchain integration, --skip-hooks, and Atmos Pro/local output.
atmos-modernization
Atmos Modernization: migrate deprecated or legacy Atmos patterns to current names, Native CI, Atmos Pro drift detection, dependencies.components, nametemplate, and declared secrets.
atmos-pro
Atmos Pro setup and workflows: settings.pro, GitHub OIDC, affected and inventory uploads, stack locks, pro commit, workflow dispatch, merge queues, and drift detection.
atmos-sbom
Atmos SBOM provenance: CycloneDX and SPDX generation from vendor and Terraform evidence, coverage diagnostics, NTIA validation, and native CI workflow-artifact publication.
atmos-version
Atmos Version Tracker: version tracks, lock files, managed external dependency versions, atmos version track commands, !version, file managers, update policy, pinning, and CI verification.
atmos-cache
Atmos caching: CI cache configuration and commands, GitHub Actions cache integration, Terraform registry cache mirror/list/prune/stats/trust, and cache modernization guidance.