# Atc Remediation

> Walk through ATC (ABAP Test Cockpit) violations methodically, grouped by category, with concrete fixes per finding. Use when the user asks to fix, remediate, address, or triage ATC findings on an ABAP object, package, or transport. Refuses pseudo-comment suppressions by default. Applies the rule set in ../CLAUDE.md (loaded on invocation). Targets modern ABAP — BTP ABAP Environment and S/4HANA on-…

- **Type:** Skill
- **Install:** `agentstack add skill-matt1as-claude-abap-skills-atc-remediation`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [matt1as](https://agentstack.voostack.com/s/matt1as)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [matt1as](https://github.com/matt1as)
- **Source:** https://github.com/matt1as/claude-abap-skills/tree/main/abap-cloud-rap/atc-remediation

## Install

```sh
agentstack add skill-matt1as-claude-abap-skills-atc-remediation
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# abap-cloud-rap:atc-remediation

Walk through ATC violations from the connected ABAP system and fix them methodically, grouped by category, with an explanation per finding.

## What this command does

You are taking ATC (ABAP Test Cockpit) results, grouping them by check category, and proposing a concrete fix for each — applying the rules in `../CLAUDE.md`. Pseudo-comment suppressions are off-limits unless the user explicitly justifies and approves them.

**MCP caveat (read carefully).** The official `SAPSE.adt-vscode` 1.0 MCP does **not** expose an ATC tool. To use this skill today, the user must paste ATC results (from ADT in VS Code) inline, or attach a community MCP that exposes ATC. Do not invent ATC results from imagination.

## Inputs to collect

If not provided, ask which of these to target. Default to the narrowest scope.

- A single ABAP object name
- A package name
- A transport request number
- An existing ATC run / result ID

Also ask which check variant to run against, defaulting to **`ABAP_CLOUD_DEVELOPMENT_DEFAULT`** for ABAP Cloud development scope.

## Procedure

1. **Get ATC results.** If the connected MCP exposes an ATC tool, run it against the chosen scope and variant. Otherwise — and that includes the official `SAPSE.adt-vscode` 1.0 MCP, which has no ATC tool — ask the user to paste ATC results from ADT or attach a community MCP that does.
2. **Group findings by check category.** Typical categories:
   - **Clean Core / Cloud compatibility** — unreleased API usage, direct SELECT on SAP-owned tables, language-version violations
   - **Security & Authorization** — missing authorization checks, unsafe SQL, hard-coded user IDs
   - **Performance** — `SELECT *`, missing indexes, table reads in loops
   - **Code quality / Clean ABAP** — magic numbers, method length, parameter count, `CREATE OBJECT`, chained declarations
   - **CDS / RAP modelling** — missing mandatory annotations, incorrect composition/association, missing draft setup
   - **Testing** — missing ABAP Unit, test classes that hit live data
3. **For each finding, in priority order (Cloud compatibility → Security → Performance → Code quality → CDS/RAP → Testing):**
   - State the violation in one sentence
   - Cite the ATC check name and severity
   - Identify the root cause — name the rule from `CLAUDE.md` that applies
   - Show the fix as a Before/After code snippet
   - Propose the action: **auto-apply**, **ask before applying**, or **manual only** (see severity ladder below)
4. **Severity ladder for auto-apply decisions:**
   - **Auto-apply candidates** — mechanical fixes that cannot change behavior: missing annotations (`@AccessControl.authorizationCheck`, `@AbapCatalog.preserveKey`), `CREATE OBJECT → NEW`, `READ TABLE + sy-subrc → line_exists`, chained `DATA:` declarations split. Even auto-apply candidates require batch confirmation, never silent application.
   - **Ask-before-applying** — fixes that touch logic shape but not semantics: `EXPORTING → RETURNING` (only if no caller depends on `IS SUPPLIED`), method extraction, magic-number → named constant.
   - **Manual only** — fixes that change interfaces, exceptions, or data access patterns: replacing `SELECT FROM vbak` with `SELECT FROM I_SalesOrder` (column names differ), replacing unreleased function modules, removing a missing `authorization` block.
5. **Never suppress with pseudo-comments unsolicited.** `"#EC NOTEXT`, `"#EC CI_USAGE_OK`, and friends are not fixes. Refuse to insert them by default. If the user requests suppression, demand: (a) the specific check name, (b) a one-sentence written justification, (c) a JIRA/issue link if one exists. Emit the pseudo-comment with the justification in a comment above it.
6. **After each batch of fixes, re-run ATC via MCP** and report the delta: violations resolved, violations remaining, new violations introduced (if any — back out the offending change).

## Output format

```
# ATC Remediation — 

Variant: 
Total findings: 

## Category breakdown
| Category                       | Total | Auto-apply | Ask | Manual |
|--------------------------------|-------|------------|-----|--------|
| Clean Core / Cloud             | N     | N          | N   | N      |
| Security & Authorization       | N     | N          | N   | N      |
| Performance                    | N     | N          | N   | N      |
| Code quality / Clean ABAP      | N     | N          | N   | N      |
| CDS / RAP modelling            | N     | N          | N   | N      |
| Testing                        | N     | N          | N   | N      |

## Findings

### Category: Clean Core / Cloud
#### F-001 — 
- **Object:**  line 
- **ATC check:**  — severity 
- **Root cause rule:** 
- **Before:**
` ` `abap

` ` `
- **After:**
` ` `abap

` ` `
- **Disposition:** auto-apply | ask | manual
- **Note:** 

(repeat per finding, grouped by category)

## Apply plan
- Auto-apply batch: N changes across M objects — confirm before writing.
- Ask-before-applying: N changes — I will confirm each one.
- Manual: N changes — listed above with full context for you to do by hand.

## Suppressions requested by user

```

## Hard rules for this command

- **Prefer ATC via MCP when one is available.** Fall back to pasted ATC output only when no MCP exposes ATC; never invent ATC findings.
- **Always group by category.** A flat list of 200 findings is unactionable.
- **Always cite the ATC check name.** "Fix this" is not a remediation.
- **Never apply a fix that changes semantics without asking.** EXPORTING→RETURNING is borderline — confirm.
- **Refuse pseudo-comment suppression by default.** Only emit with an explicit user-provided justification in a comment above the suppressed line.
- **Re-run ATC after each batch.** Report the delta. If new findings appear, roll back the change that introduced them and report.
- **One object = one transaction.** Do not write across many objects in a single irreversible batch.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [matt1as](https://github.com/matt1as)
- **Source:** [matt1as/claude-abap-skills](https://github.com/matt1as/claude-abap-skills)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-matt1as-claude-abap-skills-atc-remediation
- Seller: https://agentstack.voostack.com/s/matt1as
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.