Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vigneshbarani24/sap-superpowers --skill btpgit clone --depth 1 https://github.com/vigneshbarani24/sap-superpowersWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vigneshbarani24/sap-superpowers/btp)<a href="https://agentmods.dev/skills/vigneshbarani24/sap-superpowers/btp"><img src="https://agentmods.dev/badge/skills/vigneshbarani24/sap-superpowers/btp/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vigneshbarani24/sap-superpowers/btp"><img src="https://agentmods.dev/badge/skills/vigneshbarani24/sap-superpowers/btp.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.01900 |
| Opus 5 | $0.00023 | $0.00950 |
| Sonnet 5 | $0.00009 | $0.00380 |
| Haiku 4.5 | $0.00005 | $0.00190 |
Grade A, and why
btp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
BTP (SAP Business Technology Platform)
Enforces secure, portable, multi-tenant-aware BTP architecture — no hard-coded credentials, no monolithic subaccount designs, no skipped security configurations.
Content Routing
| Topic | Section |
|---|---|
| Subaccount design | Subaccount Architecture |
| CF vs Kyma choice | Runtime Decision |
| CAP development | CAP Patterns |
| Security / XSUAA | Security Patterns |
| HANA Cloud | HANA Cloud Patterns |
| Destinations | Destination Service |
Iron Laws
- ALWAYS CONSIDER MULTI-TENANCY FROM DAY ONE. Retrofitting multi-tenancy is 3-5x the effort of designing it in. Every BTP solution must document its tenancy model (single vs. multi) before architecture is approved.
- NEVER HARD-CODE CREDENTIALS. No passwords, client secrets, or connection strings in code, config files, or environment variables set manually. All credentials live in the Credential Store, Destination Service, or Secret Store (Kyma). Hard-coded credentials will be rotated, and your app will break at 2am.
- ALWAYS USE THE DESTINATION SERVICE FOR BACKEND CONNECTIVITY. Direct URL construction bypasses certificate management, load balancing, and the principal propagation chain. Destination Service is mandatory for all S/4HANA, on-prem, and external system calls.
- NEVER SKIP XSUAA SCOPE CHECKS. An application that doesn't enforce scopes grants every authenticated user admin-level access. Define roles, role collections, and scopes in
xs-security.jsonbefore the first protected endpoint is written. - NEVER DEPLOY TO PRODUCTION WITHOUT A SEPARATE SUBACCOUNT. Dev / Test / Prod are separate subaccounts, not separate spaces in the same subaccount. Shared subaccounts share entitlements, quotas, and blast radius.
Rationalization Table
| Agent Will Try To... | Why It Seems Reasonable | Why It Fails | Counter |
|---|---|---|---|
Put credentials in default-env.json |
"It's only for local dev, not production" | default-env.json gets committed to git; rotated credentials break local envs for everyone |
Use cf env export or .env in .gitignore; use Credential Store for real secrets |
| Use one subaccount for all landscapes | "Simpler to manage, fewer accounts" | Single subaccount = single quota pool; a runaway dev workload can starve production | Iron Law 5: Separate subaccounts are architecture, not bureaucracy |
Skip xs-security.json scope design |
"We'll add security after the PoC works" | XSUAA app registration cannot be easily retrofitted; scope names become API contracts | Define scopes on day one; they are cheap to define, expensive to change |
| Build on CF because it's familiar | "We've always used CF" | Kyma is mandatory for some scenarios (event mesh, complex Kubernetes workloads); choose based on requirements | See Runtime Decision section; document the choice with criteria |
Use hdi-shared plan for production |
"It's the easy HANA Cloud option" | hdi-shared is for dev/test; production requires dedicated HANA Cloud instance with HA config |
Check service plan before provisioning; document the plan choice in architecture |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 137 lines · 46 tokens per session scan A 211cb773dd9e
btp is a skill published in the GitHub repository vigneshbarani24/sap-superpowers (9 stars, last pushed 17d ago), licensed MIT. It adds 46 tokens to every session and 1,900 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
sap-expert
Expert in SAP ERP systems, ABAP programming, SAP HANA, S/4HANA, Fiori applications, and SAP integration patterns including OData, RFC, and IDoc. Use when the user mentions ERP, enterprise, business apps, ABAP, HANA, or S/4HANA, or when the task involves SAP Ecosystem, ABAP Development, Integration Technologies, or…
btp-abap-environment
Help with SAP BTP ABAP Environment setup and development including service instance creation, ADT connectivity, communication arrangements, communication scenarios, inbound/outbound services, destination configuration, identity and access management, software components, and first-project scaffolding. Use when users…
sap-btp-developer-guide
Develops business applications on SAP Business Technology Platform (BTP) using CAP (Node.js/Java) or ABAP Cloud. Use when: building cloud applications on SAP BTP, deploying to Cloud Foundry or Kyma runtimes, integrating with SAP HANA Cloud, implementing SAP Fiori UIs, connecting to remote SAP systems, building…
sap-btp-integration-suite
Enterprise integration solutions using SAP Integration Suite on BTP. Covers Cloud Integration (iFlows), API Management, Event Mesh, Edge Integration Cell, Integration Advisor, Trading Partner Management, and Migration Assessment. Use for building integration flows, managing API proxies, event-driven architectures…
sap-btp-connectivity
SAP BTP Connectivity skill covering Destination Service, Connectivity Service, Cloud Connector, Connectivity Proxy, and Transparent Proxy for Kubernetes. Use when configuring destinations (HTTP, RFC, LDAP, MAIL, TCP), setting up cloud-to-on-premise connectivity, implementing OAuth and principal propagation, deploying…
Pynchy Ops
Use when managing the pynchy service on the server — deploying changes, observing logs, checking service status, restarting the service, setting up GitHub auth, rebuilding the agent container, or running commands on the live Pynchy host. Also use when interacting with the LiteLLM proxy — investigating failed requests…