Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add BoxLogoDev/sapstack --skill sap-gtsgit clone --depth 1 https://github.com/BoxLogoDev/sapstackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/boxlogodev/sapstack/sap-gts)<a href="https://agentmods.dev/skills/boxlogodev/sapstack/sap-gts"><img src="https://agentmods.dev/badge/skills/boxlogodev/sapstack/sap-gts/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/boxlogodev/sapstack/sap-gts"><img src="https://agentmods.dev/badge/skills/boxlogodev/sapstack/sap-gts.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 286 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 287 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
- medium Agent Snooping · line 288 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00150 | $0.02436 |
| Opus 5.5 | $0.00060 | $0.00974 |
| Sonnet 5.5 | $0.00030 | $0.00487 |
| Haiku 4.5 | $0.00015 | $0.00244 |
Grade A, and why
sap-gts scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 290 lines — stays where its author put it; the contents beside it link to each section on GitHub.
1. Environment Intake Checklist
Before answering any GTS question, collect:
- SAP Release (SAP GTS 10.x / 11.0 / S/4HANA for International Trade)
- GTS 배포: Standalone (별도 시스템) / Embedded in S/4 (International Trade)
- Korea Customs Service 연동 여부 (UNI-PASS)
- 거래 유형 (수출 / 수입 / 양방향)
- 규제 범위 (Export Control / Compliance / Customs Management / Risk Management)
- Feeder System (ECC / S/4HANA 연동)
2. GTS 주요 영역 (Areas)
2-1. Compliance Management
- Sanctioned Party List (SPL) Screening — 제재 대상자 검색
- Embargo Check — 금수조치 국가 검사
- Legal Control — 허가·라이선스 필요성 판단
2-2. Customs Management
- Export Declaration — 수출신고
- Import Declaration — 수입신고
- Transit Procedures — 통과·환적
- Special Customs Procedures — 관세지 유형, 특수 절차
2-3. Risk Management
- Letter of Credit Management — 신용장 관리
- Preference Management — 원산지 결정, FTA
- Restitution Management — 수출 환급
2-4. Electronic Compliance Reporting
- Intrastat (EU 내수)
- Customs Filing — 국가별 전자 신고
- Korea UNI-PASS — 한국 관세청 연동
3. Core Transaction Codes (GTS 네임스페이스)
GTS는 /SAPSLL/ 네임스페이스를 사용합니다.
| T-code | 용도 |
|---|---|
/SAPSLL/MENU_LEGALR3 |
GTS Main Menu |
/SAPSLL/COMPLR3 |
Compliance workbench |
/SAPSLL/CUS_CUHD_R3 |
Customs document |
/SAPSLL/LCLOG |
License log |
/SAPSLL/PREF_CUST |
Preference determination |
/SAPSLL/PRODUCT_R3 |
Product master |
/SAPSLL/SPL_AUDIT |
SPL audit log |
/SAPSLL/CTSSPLAUD |
SPL screening monitor |
/SAPSLL/MENU_LEGALSPL |
SPL configuration |
4. Sanctioned Party List (SPL) Screening
프로세스
- Business Partner 생성·변경 → SPL screening 자동 트리거
- Customs document 생성 시 재검사
- Match 발견 → Block 또는 Hold for review
설정
- Lists 구독: OFAC (US), EU, UN, 국가별
- Match criteria: 이름, 주소, 도시, 국가, 생년월일
- Fuzzy logic: phonetic matching (예: Kim vs Gim)
한국 현장
- OFAC (미국 재무부) 필수 — 대미 수출 시
- 전략물자 수출입 고시 (산업통상자원부) — 한국 자체 리스트
- 한국 기업은 SPL false positive가 많음 (동명이인)
주요 T-code
/SAPSLL/SPL_AUDIT— 감사 로그/SAPSLL/CTSSPLAUD— 실시간 모니터
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/best-practices/governance.md 2.2 KB
- references/best-practices/operational.md 1.3 KB
- references/best-practices/period-end.md 1.0 KB
- references/de/quick-guide-de.md 1.5 KB
- references/en/quick-guide-en.md 1.4 KB
- references/ja/quick-guide-ja.md 1.5 KB
- references/ko/quick-guide.md 1.2 KB
- references/ko/SKILL-ko.md 5.9 KB
- references/korea-customs-uni-pass.md 5.2 KB
- references/vi/quick-guide-vi.md 1.7 KB
- references/zh/quick-guide-zh.md 1.3 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 290 lines · 150 tokens per session scan A e050df1620be
sap-gts is a skill published in the GitHub repository BoxLogoDev/sapstack (20 stars, last pushed 1mo ago), licensed MIT. It adds 150 tokens to every session and 2,436 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
sap-expert
Expert in SAP ERP systems, ABAP programming, SAP HANA, S/4HANA, Fiori applications, and SAP integration patterns including OData, RFC, and IDoc. Use when the user mentions ERP, enterprise, business apps, ABAP, HANA, or S/4HANA, or when the task involves SAP Ecosystem, ABAP Development, Integration Technologies, or…
light-research-ethics
A research-integrity and ethics checking system that scans research work for risks such as fabricated data, exaggerated conclusions, plagiarism, privacy problems, copyright issues, and missing disclosures.
light-patent-disclosure
A process for preparing a documented software or research invention for review by a patent attorney or patent agent. It records the problem, technical solution, differences from nearby work, supporting examples, and needed figures.
light-software-copyright
An audit workflow that compares completed code with a development plan’s work items, acceptance criteria, and tests. It reports gaps, logic errors, edge cases, and missing coverage with file and line references.
sap-api-policy
Evidence-based assessment of whether an SAP API/interface usage scenario aligns with the SAP API Policy (v.4.2026a). Use whenever someone asks whether a way of calling SAP is allowed/compliant — e.g. Published API vs internal/private/"confidential" API status, "Documented Use", whether a third-party tool / iPaaS /…
vat
Prepare and review the Swedish VAT return (momsdeklaration). Use when the user says "moms", "momsdeklaration", "VAT return", "momsrapport", asks about rutor, EU-moms, omvand skattskyldighet, or when a VAT period is ending.