Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add eljoujat/sapcc-skill --skill sapcc-skillgit clone --depth 1 https://github.com/eljoujat/sapcc-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eljoujat/sapcc-skill/sapcc-skill)<a href="https://agentmods.dev/skills/eljoujat/sapcc-skill/sapcc-skill"><img src="https://agentmods.dev/badge/skills/eljoujat/sapcc-skill/sapcc-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/eljoujat/sapcc-skill/sapcc-skill"><img src="https://agentmods.dev/badge/skills/eljoujat/sapcc-skill/sapcc-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00123 | $0.02580 |
| Opus 5 | $0.00062 | $0.01290 |
| Sonnet 5 | $0.00025 | $0.00516 |
| Haiku 4.5 | $0.00012 | $0.00258 |
Grade A, and why
sapcc-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 241 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SAP Commerce Cloud Skill
Interact with a SAP Commerce Cloud (Hybris/CCv2) instance using two complementary companion clients:
sapcc-hac-client(scripts/execute.js) — Groovy scripts and FlexibleSearch queries against the HAC (application data & business logic)sapcc-portal-cli(scripts/portal.js) — Cloud Portal REST API (environments, builds, deployments, backups, scaling, endpoints, certificates, scheduled activities, properties, roles)
Designed to be extended with additional SAP CC capabilities over time.
The skill automatically decides whether to use:
- FlexibleSearch – for data queries (SELECT/WHERE on SAP CC types)
- Groovy script – for complex logic, service calls, multi-step operations, or writes
- Cloud Portal API – for DevOps/platform operations (builds, deployments, environment lifecycle, scaling, backups, certs, roles)
Works with Claude Code, Cursor, Copilot, Codex, Pi and any agent compatible with the Agent Skills format.
Setup
Dependencies are installed automatically the first time execute.js or portal.js runs — no manual npm install needed.
Create a .env file in your project root (or in the skill directory as fallback):
cp <skill-dir>/.env.example .env
# Then fill in your values
Required .env variables for HAC (Groovy/FlexSearch):
HAC_URL=https://backoffice.<your-instance>.commerce.ondemand.com
HAC_USERNAME=admin
HAC_PASSWORD=your_password
HAC_IGNORE_SSL=false # set true for self-signed certs
HAC_TIMEOUT=30000
Required .env variables for Cloud Portal (builds/deployments/environments/...):
PORTAL_API_URL=https://portalapi.commerce.ondemand.com/v2
PORTAL_SUBSCRIPTION_CODE=your_subscription_code
PORTAL_TOKEN_ENDPOINT=https://ycloud.accounts.ondemand.com/oauth2/token
PORTAL_CLIENT_ID=your_client_id
PORTAL_CLIENT_SECRET=your_client_secret
PORTAL_RESOURCE=your_resource_urn
PORTAL_TIMEOUT=30000
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +63 lines · +35 tokens per session 083bcbed9991
- 9d ago First seen · 178 lines · 88 tokens per session scan A 324fe83daff0
sapcc-skill is a skill published in the GitHub repository eljoujat/sapcc-skill (3 stars, last pushed 5d ago), licensed MIT. It adds 123 tokens to every session and 2,580 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ship-it-or-fix-it
Oracle-frozen Builder and independent-Judge convergence cycle. Load ONLY when the operator explicitly sets Governance Dial G2 for the task, or explicitly names this skill or an active work unit already running it. Never auto-activate on task class, such as security, auth, or payments. If a task seems to warrant G2 and…
test-verification
Requires behavioral, failure-path, and durable-seam evidence for tests and review. Use when writing tests, reviewing test coverage, assessing behavioral test quality, or accepting high-risk behavior on test evidence.
portable-adaptive-planning
Use for planning, roadmaps, design, architecture, sequencing, or before consequential work when no current FINAL plan plus GO covers it. Fire before changes to data or schemas, credentials or auth, production or releases, repository or source-home boundaries, irreversible work, or materially costly mistakes. Re-enter…
sanctifai
Human-in-the-loop skill for AI agents. Use when your agent needs humans to review, approve, or complete a task. Provides REST API and MCP (Model Context Protocol) integration with long-polling and webhooks. No server required — agents self-register and get responses back asynchronously.
reasoning-doctrine
The working method for every nontrivial task: frame the objective, ground load-bearing facts, converge on a route, execute without drift, and verify before delivery. Use for analysis, planning, implementation, debugging, document work, reviews, and multi-stage tasks.
write-maintainable-code
Evaluate minimum-sufficient implementation routes and enforce the selected route for a fixed, authorized outcome. Use after outcome, scope, authority, and acceptance evidence are fixed. Do not choose outcomes, set acceptance, adjudicate governance, grade finished work, design tests alone, conduct security audits, or…