Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add marcellourbani/vscode_abap_remote_fs --skill explore-uigit clone --depth 1 https://github.com/marcellourbani/vscode_abap_remote_fsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/marcellourbani/vscode_abap_remote_fs/explore-ui)<a href="https://agentmods.dev/skills/marcellourbani/vscode_abap_remote_fs/explore-ui"><img src="https://agentmods.dev/badge/skills/marcellourbani/vscode_abap_remote_fs/explore-ui.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00112 | $0.07205 |
| Opus 5 | $0.00056 | $0.03603 |
| Sonnet 5 | $0.00022 | $0.01441 |
| Haiku 4.5 | $0.00011 | $0.00720 |
Grade A, and why
explore-ui scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 282 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Explore UI — Phase 2 (of 7)
Phase order: analyze-and-plan (1) → explore-ui (2) → design-cases (3) → define-data (4) → prepare-data (5) → build-scripts (6) → run-scripts (7).
This phase produces ONE artifact: tests/<PROGRAM>/test-cases/_screens.md, and reconciles what you discover back into _findings.md. It does not write test cases or data specs.
For bounded, self-contained support work, use sap-task-helper with explicit inputs, allowed writes, and an output contract.
What _screens.md IS — read this before anything else
_screens.md is a map of the live web UI as it renders in the browser (SAP WebGUI, inside its ITS iframe). Phase 6 (build-scripts) turns each control it lists into a Playwright call — sap.setField("File path", ...), sap.clickButton("Execute"), sap.selectRadio("Report") — using the EXACT accessible name / on-screen label you record here.
_screens.md is NOT a description of the ABAP selection screen from the source code. It contains no ABAP variable names (p_file, r_upl, s_site), no MODIF IDs, no LOOP AT SCREEN/MODIFY SCREEN snippets, no message-class listings, no method names or line numbers, and no screens you did not actually open and observe. If a line couldn't be used by Phase 6 to write a locator, it does not belong here.
You must produce this file by opening the browser and looking. A _screens.md derived from ABAP source instead of live observation is the specific failure this phase exists to prevent — it is worthless to Phase 6 because source-derived labels are not the browser's accessible names.
How to actually drive the WebGUI — read this, it is where runs fail
You explore with your interactive browser tool's accessibility snapshot, NOT with Playwright code. This is the single most common time-sink: agents try Playwright selectors, everything times out, and they give up and derive from source. Don't.
- Snapshot with the accessibility-tree action, and act by
ref. In VS Code Copilot these are:read_page(returns the accessibility tree WITH elementrefvalues — your PRIMARY tool),click_elementwithref=<ref>(click a radio/button/cell), andtype_in_pagewithref=<ref>(enter text). Use your environment's equivalent snapshot/click-by-ref/type-by-ref actions if the names differ.read_pagesees INSIDE the SAP ITS iframe automatically — you do NOT target the iframe yourself. read_pagebefore you act and after every server round-trip. Clicking a radio or Execute triggers SAP's PBO round-trip and re-renders the screen; re-snapshot to get the new controls and freshrefs (old refs go stale).screenshot_pageis for visual confirmation ONLY — it has norefs, so you cannot act from it, and it does not give you accessible names. Never write_screens.mdfrom a screenshot alone.- Do NOT use Playwright during exploration.
page.locator(...),frameLocator(...),getByRole(...),page.evaluate(...),text=...do not reliably reach the ITS iframe from page level and will time out. Playwright runs only inside real specs (Phase 6/7 viaabapfs_run_playwright_tests), never during exploration. If you catch yourself writingpage.locator, stop and useread_page+ref. - Generic roles are normal — record the accessible NAME. ITS renders many controls (radios, F4 triggers, ALV cells) with role
genericrather thanradio/button. That is fine and expected: capture the accessible name (e.g."Upload","Report"), because the runtime helpers (selectRadio,clickButton) locate by name and handle the missing ARIA role. Do not get stuck hunting for aradiorole ITS never emits. - If it seems stuck, VERIFY before reacting — and never shortcut. SAP's PBO round-trip and the ITS "Please wait…" splash can look like a hang or a timeout when the page actually loaded fine. If an action seems to time out, re-run
read_pageand check whether the screen advanced (it usually did) before concluding anything failed. A perceived timeout is NEVER a reason to give up and write_screens.mdfrom source. Know your escape hatches from the start, so you reach for them instead of shortcutting: if a control genuinely won't drive, or the browser is truly unreachable after a retry, STOP and either (a) ask the user for help/data, or (b) ask the user to record the flow via thesap-webgui-recordingskill ("ABAP FS: Record SAP WebGUI Flow"). Asking is always allowed and always better than a source-derived guess — you were told this before you started precisely so you don't discover it only after cutting a corner.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 282 lines · 112 tokens per session scan A 7dcbd65b35dd
explore-ui is a skill published in the GitHub repository marcellourbani/vscode_abap_remote_fs (388 stars, last pushed 5d ago), licensed MIT. It adds 112 tokens to every session and 7,205 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sap-sac-test-automation
SAP Analytics Cloud (SAC) automated testing skill for designing capability-gated browser discovery and deterministic Playwright test suites for SAC stories, dashboards, reports, planning workflows, comments, permissions, visual regression, and reusable QA automation. This skill should be used when building SAC…
browse
Drive a real browser through Aside: open a page, read it, click through a flow, take screenshots, check console errors. (gstack).
playwright-cli
A command-line tool for controlling Chromium, Firefox, and WebKit browsers, including navigation, page interaction, screenshots, PDFs, and recorded actions.
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
browser-qa
A browser-based quality check for deployed web pages and user flows. It uses browser automation to test rendering, navigation, forms, interactions, responsive behaviour, and accessibility-related issues.
test-electron-app
Drive the real running PostHog Electron app (live tRPC, workspace-server, real data) over CDP with agent-browser. Connect to the running app on port 9222, test desktop changes against a local Django stack, snapshot the accessibility tree, inspect network requests, and screenshot only when explicitly asked. Use when…