# Clean Core Check

> Check an ABAP object or package for clean core compliance — unreleased APIs, direct SELECT on SAP-owned tables, classic constructs disallowed in ABAP Cloud, modifications to SAP standard. Use when the user asks to audit, verify, or check clean core compliance, ABAP Cloud compatibility, released API usage, or extension point usage. Produces a categorised report with hard violations and soft warnin…

- **Type:** Skill
- **Install:** `agentstack add skill-matt1as-claude-abap-skills-clean-core-check`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [matt1as](https://agentstack.voostack.com/s/matt1as)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [matt1as](https://github.com/matt1as)
- **Source:** https://github.com/matt1as/claude-abap-skills/tree/main/abap-cloud-rap/clean-core-check

## Install

```sh
agentstack add skill-matt1as-claude-abap-skills-clean-core-check
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# abap-cloud-rap:clean-core-check

Check an ABAP object or package for clean core compliance. Pulls the source via the SAP ABAP MCP Server and produces a categorised compliance report with concrete remediation steps.

## What this command does

You are auditing one or more ABAP objects for compliance with the **clean core** principles enforced by ABAP Cloud development model. The rules in `../CLAUDE.md` define what is allowed; this command finds what is not. Output is a structured report — **read-only**, no writes back via MCP.

## Inputs

If not provided, ask. Defaults to the narrowest scope.

- An ABAP object name (class, function group, program, include, CDS entity, BDEF)
- A package name
- A transport request — check every object in the transport

## What to check

For each object in scope, look for the following. Each maps to a rule in `CLAUDE.md`.

### Hard violations — never allowed in either BTP or S/4HANA on-prem Cloud development

| Check                                                | Source rule                              |
|------------------------------------------------------|------------------------------------------|
| Use of an SAP class/interface/FM with no C1 release  | `released-apis-only`                     |
| Direct `SELECT` from a SAP-owned database table      | `no-direct-select-on-sap-owned-tables`   |
| Classic dynpro (`CALL SCREEN`, screen exits)         | `abap-cloud-language-scope-only`         |
| `SUBMIT`, `CALL TRANSACTION`, `LEAVE TO`             | `abap-cloud-language-scope-only`         |
| `FORM` / `PERFORM`                                   | `abap-cloud-language-scope-only`         |
| `CALL FUNCTION ... DESTINATION 'NONE'` for internal logic | `abap-cloud-language-scope-only`    |
| Modification of SAP standard objects                  | `no-modification-of-sap-standard`        |
| Use of an SAP enhancement point that is not released | `no-modification-of-sap-standard`        |
| `define view` (legacy DDL view) instead of `define view entity` | `interface-entity-required-annotations` |

### Soft warnings — allowed in S/4HANA on-prem Cloud development for transitional reasons, never allowed in BTP

| Check                                                | Note                                                        |
|------------------------------------------------------|-------------------------------------------------------------|
| Use of a SAP API released only with `Use System-Internally` contract | Allowed on-prem during migration, hard-blocked on BTP |
| Released-API use that is deprecated and slated for removal | Will become a hard violation in a future release |
| Custom CDS view selecting from another *unreleased* custom view | Allowed today, but introduces a chain that will break |

## Procedure

1. **Get the source.** The official `SAPSE.adt-vscode` 1.0 MCP does **not** expose object-source reads, so ask the user to paste the source inline (from ADT in VS Code) or attach a community MCP that exposes reads. Do not paraphrase or imagine source code.
2. **For each object, walk the hard checks.** Record every hit with: object, line/element, check name, root-cause rule, and a concrete remediation.
3. **Then walk the soft checks** for objects targeting S/4HANA on-prem. Skip soft checks if the target is BTP — every soft finding is hard there.
4. **For every finding, propose a concrete fix.** Examples:
   - Direct `SELECT vbak` → "use released `I_SalesOrder`; field `VBELN` becomes `SalesOrder`, `NETWR` becomes `TotalNetAmount`"
   - Unreleased FM call → "use released class `` instead; signature: ``"
   - `define view ZX_...` → "migrate to `define view entity ZX_...`; remove `@AbapCatalog.sqlViewName`"
   - `PERFORM process_order` → "move logic to a method on a `FINAL` class; declare per Clean ABAP `methods-do-one-thing-and-stay-small`"
5. **Do not write changes.** This command is read-only. The user runs `/abap-cloud-rap:atc-remediation` or fixes by hand.

## Output format

```
# Clean Core Compliance Report — 

Target system: BTP | S/4HANA on-prem
Objects audited: 
Hard violations: 
Soft warnings: 

## Hard violations
(Listed by object, then by check.)

### Object: 
#### HV-001 — 
- **Where:**  line 
- **Check:** 
- **Rule:** 
- **Found:**
` ` `abap

` ` `
- **Fix:**
` ` `abap

` ` `
- **Notes:** 

(repeat per finding)

## Soft warnings (S/4HANA on-prem only)
(Same structure as hard violations; only emitted when target is S/4HANA on-prem.)

## Summary
| Object                | Hard | Soft | Clean core compliant? |
|-----------------------|------|------|-----------------------|
|                 | N    | N    | yes / no              |
...

## Recommended next actions
1. Fix the hard violations first — they prevent activation on BTP.
2. For ATC-checkable findings, run `/abap-cloud-rap:atc-remediation` to apply mechanical fixes in batches.
3. For semantic migrations (e.g. `vbak → I_SalesOrder` with field renames), do them by hand and re-run this command to confirm.
4. Re-run this command after fixes to confirm.
```

## Hard rules for this command

- **Read-only.** No writes back via MCP. Ever.
- **Always state the target system.** Hard vs soft violation depends on it.
- **Always cite the check name and the source rule.** Never present a finding without both.
- **Always show a concrete remediation.** A finding without a fix is not useful.
- **For field-name migrations (e.g. `vbak.vbeln → I_SalesOrder.SalesOrder`), list every renamed field used in the surrounding code** — not just the table swap. Half a migration is worse than none.
- **Pseudo-comment suppression is not a remediation.** If the user wants to ignore a finding, they should justify it through `/abap-cloud-rap:atc-remediation`, not here.
- **Do not include findings that have no rule in `CLAUDE.md`.** This is a compliance check against the library, not a free-form code review.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [matt1as](https://github.com/matt1as)
- **Source:** [matt1as/claude-abap-skills](https://github.com/matt1as/claude-abap-skills)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-matt1as-claude-abap-skills-clean-core-check
- Seller: https://agentstack.voostack.com/s/matt1as
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.