Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add marcellourbani/vscode_abap_remote_fs --skill analyze-and-plangit clone --depth 1 https://github.com/marcellourbani/vscode_abap_remote_fsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/marcellourbani/vscode_abap_remote_fs/analyze-and-plan)<a href="https://agentmods.dev/skills/marcellourbani/vscode_abap_remote_fs/analyze-and-plan"><img src="https://agentmods.dev/badge/skills/marcellourbani/vscode_abap_remote_fs/analyze-and-plan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/marcellourbani/vscode_abap_remote_fs/analyze-and-plan"><img src="https://agentmods.dev/badge/skills/marcellourbani/vscode_abap_remote_fs/analyze-and-plan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.08467 |
| Opus 5 | $0.00063 | $0.04234 |
| Sonnet 5 | $0.00025 | $0.01693 |
| Haiku 4.5 | $0.00013 | $0.00847 |
Grade A, and why
analyze-and-plan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 397 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Analyze & Plan — Phase 1 (of 7)
The SAP UI testing workflow is split into seven standalone phases so no single step is rushed:
- analyze-and-plan (this skill) — read the source →
_flow.md+_units.md+_findings.md. - explore-ui — explore the live WebGUI in a browser →
_screens.md. - design-cases — write one
TC-XXX.mdper candidate case, reviewed and indexed. - define-data — write each
TC-XXX.data.mdrequirement spec. - prepare-data — resolve those specs into per-system
data.jsoncaches. - build-scripts — write one
TC-XXX.spec.tsper runnable case. - run-scripts — execute, verify, and produce evidence.
This phase produces THREE reference artifacts under tests/<PROGRAM>/test-cases/: _flow.md, _units.md, and _findings.md. Together they are the full picture of the object that Phase 3 (and the reviewer) rely on. This phase does not open a browser and does not create any TC-XXX.md, _screens.md, or .data.md.
For bounded, self-contained support work, use sap-task-helper with explicit inputs, allowed writes, and an output contract.
Non-negotiable execution gate
Every required step and artifact below is a downstream prerequisite. The abapfs_run_playwright_tests tool (Phase 7) and the phase gates in between reject work whose upstream analysis was skipped, stale, incomplete, or unverified.
Why three artifacts, not one summary
A single summarised _findings.md is lossy: it is tempting to write "Data validation blocks (27 total)" as one table row. That one row is useless to Phase 3 — you cannot write 27 test cases from it, and the 27th validation (the one with the bug) silently gets no coverage. So Phase 1 produces the WHOLE picture, split by purpose:
_flow.md— functional flow (the "FS"). How the object actually runs end to end: entry events, the call tree in execution order, and the main scenarios. This is what lets a later phase understand why a branch matters and what sequence triggers a screen._units.md— unit inventory (the "TS"). Every FORM / METHOD / FUNCTION MODULE / event block, with its EFFECTIVE inputs and outputs — including DB tables read (inputs) and written (outputs), not just formal parameters. This is what drives correct post-test verification (which effects a case must verify) and correct data prep (which tables hold valid values)._findings.md— the decision surface. Every MESSAGE, every branch, every AUTHORITY-CHECK as ITS OWN ROW (never collapsed into an "(N total)" bucket), plus the enumerated candidate cases and the numeric target minimum.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 397 lines · 125 tokens per session scan A c8587c2f632e
analyze-and-plan is a skill published in the GitHub repository marcellourbani/vscode_abap_remote_fs (388 stars, last pushed yesterday), licensed MIT. It adds 125 tokens to every session and 8,467 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sap-sac-test-automation
SAP Analytics Cloud (SAC) automated testing skill for designing capability-gated browser discovery and deterministic Playwright test suites for SAC stories, dashboards, reports, planning workflows, comments, permissions, visual regression, and reusable QA automation. This skill should be used when building SAC…
sap-test-replay
Turns a recorded business scenario into a re-runnable pass/fail GUI regression test — the eCATT/CBTA equivalent the suite lacks — so a regression cycle stops meaning "re-test transactions by hand and paste screenshots into Word". A scaffold-recorded linear scenario (control IDs + screen identity + popup transitions…
sap-user-guide
Turns a recorded transaction walkthrough into an end-user training guide + UAT script — the unfunded rollout mandate everyone hand-makes from screenshots pasted into Word — composed from ground truth the suite already owns: /sap-gui-probe drives/records the transaction step by step with full screen identity, DDIC…
sap-tcd-chain
Drives a complete headless O2C business-document chain — sales order → outbound delivery → goods issue → billing — over RFC BAPIs, so regression testing gets whole document flows, not isolated documents. Each step is created via its SAP write BAPI, committed (WAIT='X'), and VBFA-verified before the next step (VBTYPN…
sap-fiori-testing
SAP Fiori/UI5 testing, accessibility, and modern UI skill. Use when writing wdi5 E2E tests, OPA5 integration tests, implementing WCAG 2.1 accessibility, using UI5 Web Components, or migrating UI5 to TypeScript. If the user mentions wdi5, OPA5, Fiori test, UI5 accessibility, WCAG, or UI5 TypeScript migration, use this…
dogfood
Systematically explore and test a mobile app on iOS/Android with agent-device to find bugs, UX issues, and other problems. Use when asked to dogfood, QA, exploratory test, find issues, bug hunt, or test this app on mobile.