@raishin/vanguard-frontier-agentic 2.11.0 → 2.13.1

package/skills/sap/sap-live-readonly-identity-trust-discovery/references/live-environment-access.md

@@ -0,0 +1,151 @@
+# Live environment access — SAP Live Read-Only Identity and Trust Discovery
+
+This reference defines credential setup, role requirements, audit log format, and redaction rules for live read-only identity and trust discovery sessions.
+
+## Credential setup
+
+### SAP Cloud Identity Services — Identity Authentication Service (IAS) API
+
+Required role: Read-only API user or IAS administrator scoped to application listing and corporate identity provider enumeration. Do not use a full IAS tenant administrator who can also create or modify applications.
+
+Recommended approach: create a dedicated IAS service user with the `Manage Applications` permission set to read-only scope, or use the IAS System as Applications option with a `Get` scope API key.
+
+```bash
+# IAS REST API — list all applications (GET only)
+curl -s -X GET \
+  "https://<IAS_TENANT>.accounts.ondemand.com/Applications/v1/" \
+  -H "Authorization: Bearer <READ_ONLY_ACCESS_TOKEN>"
+
+# IAS REST API — list corporate identity providers
+curl -s -X GET \
+  "https://<IAS_TENANT>.accounts.ondemand.com/IdentityProviders/v1/" \
+  -H "Authorization: Bearer <READ_ONLY_ACCESS_TOKEN>"
+```
+
+Never include the `<READ_ONLY_ACCESS_TOKEN>` value in any output. Replace with `[REDACTED:IAS_TOKEN]` before logging.
+
+### SAP Cloud Identity Services — Identity Provisioning Service (IPS) API
+
+Required role: IPS administrator account with read-only access to source and target system configuration and job history. Do not use credentials with provisioning job execution rights.
+
+```bash
+# IPS REST API — list all provisioning source systems (GET only)
+curl -s -X GET \
+  "https://<IPS_TENANT>.accounts.ondemand.com/ips/service/ProvisioningService/v2/Systems" \
+  -u "<IPS_USER>:[REDACTED:IPS_PASSWORD]" \
+  -H "Accept: application/json"
+
+# IPS REST API — get a specific source system connector configuration
+curl -s -X GET \
+  "https://<IPS_TENANT>.accounts.ondemand.com/ips/service/ProvisioningService/v2/Systems/<SYSTEM_ID>" \
+  -u "<IPS_USER>:[REDACTED:IPS_PASSWORD]" \
+  -H "Accept: application/json"
+
+# IPS REST API — list provisioning job history for a system (read-only)
+curl -s -X GET \
+  "https://<IPS_TENANT>.accounts.ondemand.com/ips/service/ProvisioningService/v2/Systems/<SYSTEM_ID>/Jobs" \
+  -u "<IPS_USER>:[REDACTED:IPS_PASSWORD]" \
+  -H "Accept: application/json"
+```
+
+### BTP CLI — trust and role collection enumeration
+
+Required role: **Subaccount Viewer** or **Security Administrator (read-only)** for subaccount-scope discovery; **Global Account Viewer** for cross-subaccount trust enumeration.
+
+Never use: Global Account Administrator, Subaccount Administrator, Security Administrator (with write permissions), or any role that can assign or modify trust configurations.
+
+```bash
+# Login to BTP CLI
+btp login --url https://cli.btp.cloud.sap
+
+# Confirm active context and role
+btp --info
+
+# List all trust configurations for a subaccount (read-only)
+btp list security/trust --subaccount <SUBACCOUNT_ID>
+
+# Get details of a specific trust configuration
+btp get security/trust <TRUST_CONFIG_NAME> --subaccount <SUBACCOUNT_ID>
+
+# List all role collections in a subaccount
+btp list security/role-collection --subaccount <SUBACCOUNT_ID>
+
+# Get a specific role collection (roles and assignments)
+btp get security/role-collection "<ROLE_COLLECTION_NAME>" --subaccount <SUBACCOUNT_ID>
+```
+
+### XSUAA service API (via CF CLI or BTP API)
+
+Required role: **SpaceAuditor** or **OrgAuditor** in Cloud Foundry; use a service key with only `roles.read` and `role-collections.read` scopes on the XSUAA instance.
+
+Never use: a XSUAA service key with `roles.write`, `role-collections.write`, or `user.write` scopes.
+
+```bash
+# CF CLI — confirm current user and role (read-only)
+cf org-users <ORG_NAME>
+cf space-users <ORG_NAME> <SPACE_NAME>
+
+# CF CLI — list service instances (to locate XSUAA instance)
+cf service-instances
+
+# XSUAA API — list role collections (GET only, using service key access token)
+curl -s -X GET \
+  "<XSUAA_URL>/sap/rest/authorization/v2/rolecollections" \
+  -H "Authorization: Bearer [REDACTED:XSUAA_TOKEN]"
+```
+
+## Redaction rules
+
+The following must be redacted from all output, logs, and evidence before returning to the user:
+
+| Data type | Redaction token |
+|-----------|----------------|
+| IAS access token or bearer token | `[REDACTED:IAS_TOKEN]` |
+| IPS system user password | `[REDACTED:IPS_PASSWORD]` |
+| XSUAA client secret | `[REDACTED:XSUAA_CLIENT_SECRET]` |
+| XSUAA access token | `[REDACTED:XSUAA_TOKEN]` |
+| BTP platform user password | `[REDACTED:BTP_PASSWORD]` |
+| OAuth client secret (any) | `[REDACTED:CLIENT_SECRET]` |
+| Personal email addresses beyond audit necessity | `[REDACTED:PII_EMAIL]` |
+| Personal user names beyond audit necessity | `[REDACTED:PII_USERNAME]` |
+| SAML signing certificate private key | `[REDACTED:SAML_PRIVATE_KEY]` |
+
+The data type name, key structure, and service names may remain in output. Only sensitive values are redacted.
+
+## Audit log format
+
+Every command executed must be logged in the following format before the command is run:
+
+```
+[COMMAND_LOG]
+Timestamp (UTC): <ISO 8601>
+System: <IAS tenant ID | IPS tenant | BTP subaccount ID | XSUAA instance name>
+Tool: <curl-ias | curl-ips | btp | cf | curl-xsuaa>
+Command: <exact command with arguments; credential values replaced with redaction tokens>
+Output summary: <one-line summary of what was returned>
+Redactions applied: <yes/no — what was redacted>
+```
+
+Example:
+```
+[COMMAND_LOG]
+Timestamp (UTC): 2026-06-19T11:15:00Z
+System: IAS Tenant abc-def-ghi.accounts.ondemand.com
+Tool: curl-ias
+Command: GET /Applications/v1/ Authorization: Bearer [REDACTED:IAS_TOKEN]
+Output summary: 12 IAS applications enumerated; 3 with corporate IdP federation, 9 with IAS-local authentication
+Redactions applied: yes — bearer token replaced with [REDACTED:IAS_TOKEN]
+```
+
+## Approval gate checklist
+
+Before the first live command in any session:
+
+- [ ] User has confirmed live read-only access is authorized for this session
+- [ ] Credential scope confirmed as viewer/auditor/read-only API user (role name or API scope confirmed)
+- [ ] Target system and scope explicitly identified by user (IAS tenant ID, IPS tenant, BTP subaccount ID, XSUAA instance)
+- [ ] Redaction rules reviewed and will be applied to all output
+- [ ] Personal data minimization plan confirmed for IAS and IPS user enumeration
+- [ ] User understands no state changes will be made
+
+Do not proceed until all six items are confirmed.

package/skills/sap/sap-live-readonly-identity-trust-discovery/references/official-sources.md

@@ -0,0 +1,83 @@
+# Official sources — SAP Live Read-Only Identity and Trust Discovery
+
+Use this reference when grounding IAS, IPS, XSUAA, and BTP trust enumeration commands and API calls.
+
+**Evidence level**: documentation-based (SAP Help Portal). Live evidence gathered during sessions is labeled separately as `live evidence` per the audit format in `references/live-environment-access.md`.
+
+## SAP Cloud Identity Services — Identity Authentication Service (IAS)
+
+- What Is Identity Authentication
+  https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/what-is-identity-authentication
+  source_owner: SAP SE
+  topic_supported: IAS overview, application types, corporate identity provider federation, risk-based authentication, MFA policies
+  why_needed: Authoritative source for IAS application and corporate IdP enumeration scope; defines what configuration objects this skill can discover in read-only mode
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Configure Applications in IAS
+  https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/configure-applications
+  source_owner: SAP SE
+  topic_supported: IAS application configuration — authentication schemes, corporate IdP trust, risk-based authentication policies, API access settings
+  why_needed: Defines the IAS application object model and REST API paths for read-only enumeration of application settings and corporate identity provider assignments
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP Cloud Identity Services — Identity Provisioning Service (IPS)
+
+- What Is Identity Provisioning
+  https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/what-is-identity-provisioning
+  source_owner: SAP SE
+  topic_supported: IPS overview, connector types (source, target, proxy), provisioning job types (read job, resync), transformation script structure
+  why_needed: Defines the IPS connector and job object model; establishes which API endpoints are read-only (GET) versus job-triggering (POST)
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Manage Provisioning Systems in IPS
+  https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/manage-provisioning-systems
+  source_owner: SAP SE
+  topic_supported: IPS source and target system configuration — connector properties, transformation scripts, job scheduling, job history access
+  why_needed: Defines the IPS REST API paths for reading connector configuration and job history without triggering provisioning jobs
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## SAP BTP Authorization and Trust Management Service (XSUAA)
+
+- What Is Authorization and Trust Management Service
+  https://help.sap.com/docs/btp/sap-business-technology-platform/what-is-authorization-and-trust-management-service
+  source_owner: SAP SE
+  topic_supported: XSUAA overview, role collections, role templates, scopes, OAuth 2.0 trust configuration in BTP Cloud Foundry environment
+  why_needed: Authoritative source for XSUAA role collection and scope enumeration; defines which XSUAA REST API calls are read-only (GET)
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+- Application Security Descriptor Configuration Syntax (xs-security.json)
+  https://help.sap.com/docs/btp/sap-business-technology-platform/application-security-descriptor-configuration-syntax
+  source_owner: SAP SE
+  topic_supported: xs-security.json structure — scopes, role templates, role collections, OAuth2 configuration — read to understand the objects enumerated by this skill
+  why_needed: Provides the schema for interpreting XSUAA role template and scope output returned by read-only enumeration
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## BTP Trust and Federation
+
+- Trust and Federation with Identity Providers
+  https://help.sap.com/docs/btp/sap-business-technology-platform/trust-and-federation-with-identity-providers
+  source_owner: SAP SE
+  topic_supported: BTP subaccount trust configuration, SAML 2.0 and OIDC trust to external and corporate identity providers, principal propagation, attribute mapping, default identity provider
+  why_needed: Defines the BTP trust configuration object model and the BTP CLI commands for read-only trust enumeration (`btp list security/trust`, `btp get security/trust`)
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Role Collections
+
+- Managing Role Collections in BTP
+  https://help.sap.com/docs/btp/sap-business-technology-platform/managing-role-collections
+  source_owner: SAP SE
+  topic_supported: Role collection creation, assignment to users and groups, built-in role collections, BTP CLI role collection management commands
+  why_needed: Defines the BTP CLI read-only commands for role collection enumeration (`btp list security/role-collection`, `btp get security/role-collection`) and the role collection assignment model
+  evidence_level: primary
+  last_verified: 2026-06-19
+
+## Grounding rule
+
+SAP Help Portal documentation describes available API endpoints and CLI commands. It does not prove which endpoints are available in the user's specific IAS tenant version, which IPS connector types are provisioned, or whether the credential in scope actually restricts write access. Users must confirm credential scope and target system identity before any live command is executed.

package/skills/sap/sap-live-readonly-identity-trust-discovery/references/safety-checklist.md

@@ -0,0 +1,49 @@
+# Safety checklist — SAP Live Read-Only Identity and Trust Discovery
+
+Use before every live discovery session and before every command execution.
+
+## Non-negotiables
+
+- Do not execute any command that creates, updates, deletes, assigns, rotates, triggers a provisioning job, or modifies trust configuration — even if the user explicitly requests it.
+- Do not request, accept, log, echo, or include in any output: IAS admin credentials, IPS system user passwords, XSUAA client secrets, OAuth access tokens, BTP service keys, SAML signing certificate private keys, or any credential value of any kind.
+- Do not proceed with live commands if the user has not confirmed that the credential in scope is read-only (viewer, auditor, or read-only API user role or equivalent).
+- Do not expand scope beyond what the user has explicitly authorized — if authorized for one subaccount's role collections, do not enumerate sibling subaccounts or global account trust configurations without explicit authorization.
+- Do not cache, store, or transmit live evidence outside the current session context.
+- Redact all IAS access tokens, IPS passwords, XSUAA client secrets, and personal user data (email addresses, user names) beyond audit necessity before logging or returning output.
+- Do not enumerate user-level personal data (individual user records from IAS or IPS target systems) unless the user has explicitly stated a legitimate audit scope requiring it and has confirmed data protection compliance.
+
+## Forbidden action verification
+
+Before executing any API call or CLI command, verify the HTTP method or CLI verb is on the allowed list:
+
+| Allowed HTTP methods / CLI verbs | Forbidden HTTP methods / CLI verbs |
+|----------------------------------|------------------------------------|
+| GET, list, get, describe, export, status, show, read, view | POST, PUT, PATCH, DELETE, create, update, delete, set, assign, bind, rotate, regenerate, import, trigger, run, execute, apply, approve, modify-trust |
+
+If the HTTP method or CLI verb is not on the allowed list, refuse and explain which downstream skill or authorized administrator handles that action.
+
+## What people get wrong
+
+- **Using an IAS tenant administrator for "just reading"**: A full IAS tenant administrator can create and modify applications and corporate identity providers. Use a dedicated read-only API user or a service user scoped to GET operations only.
+- **Triggering IPS provisioning jobs by accident**: The IPS API uses `POST /Jobs` to trigger a job and `GET /Jobs` to list history. Verify the HTTP method before executing. A `POST` to the Jobs endpoint triggers a live provisioning run.
+- **Including IAS access tokens in output**: IAS REST API responses may embed token endpoint metadata. Bearer tokens used in the request must never appear in logs. Replace with `[REDACTED:IAS_TOKEN]` before logging.
+- **Enumerating personal user records without a stated audit purpose**: IPS source or target system enumeration may return individual user records with email addresses and personal attributes. Collect only system-level configuration, not individual user records, unless the audit scope explicitly requires it.
+- **Assuming `btp list security/trust` cannot cause side effects**: In some BTP CLI versions, list operations may trigger internal audit log entries. This is acceptable; the key constraint is no state mutation.
+- **Scope creep across subaccounts**: A subaccount viewer credential may grant visibility across sibling subaccounts in some BTP configurations. Query only the specific subaccount in scope.
+- **Treating XSUAA token introspection as read-only for all purposes**: Token introspection exposes live token data. Enumerate role collections and scopes using the authorization API, not by inspecting live user tokens.
+
+## When to push back
+
+- Push back when the user asks to combine a read step with a write step (e.g., list role collections and then assign one to a user).
+- Push back when the user asks to trigger an IPS provisioning job "just to test" the connector.
+- Push back when credentials provided appear to have write scope (e.g., IAS tenant administrator with application creation rights, IPS administrator with job execution rights).
+- Push back when the user asks to enumerate individual user records from IAS or IPS target systems without a stated audit scope and data protection confirmation.
+- Push back when the user asks to export SAML metadata including private signing keys.
+- Push back when the user asks to enumerate systems or subaccounts outside the agreed scope.
+
+## Evidence labels
+
+- `live evidence` — directly observed from a live SAP IAS, IPS, XSUAA, or BTP system; include command, timestamp, system identifier
+- `documentation-based` — grounded in SAP official docs; no live access
+- `user-provided evidence` — stated or supplied by the user (configuration exports, screenshots, written descriptions)
+- `inference` — derived reasoning; must always be labeled as such

package/skills/sap/sap-live-readonly-identity-trust-discovery/references/workflow-and-output.md

@@ -0,0 +1,103 @@
+# Workflow and output contract — SAP Live Read-Only Identity and Trust Discovery
+
+Use this reference for all discovery workflows, command selection, and output formatting.
+
+## Allowed command patterns
+
+### IAS API (read-only, GET only)
+
+```bash
+# List all IAS applications
+GET https://<IAS_TENANT>.accounts.ondemand.com/Applications/v1/
+
+# Get a specific IAS application configuration
+GET https://<IAS_TENANT>.accounts.ondemand.com/Applications/v1/<APPLICATION_ID>
+
+# List all corporate identity providers configured in IAS
+GET https://<IAS_TENANT>.accounts.ondemand.com/IdentityProviders/v1/
+
+# Get risk-based authentication policy for an application (read-only)
+GET https://<IAS_TENANT>.accounts.ondemand.com/Applications/v1/<APPLICATION_ID>/authentication/rba
+```
+
+### IPS API (read-only, GET only)
+
+```bash
+# List all source and target systems (connectors)
+GET https://<IPS_TENANT>.accounts.ondemand.com/ips/service/ProvisioningService/v2/Systems
+
+# Get a specific connector configuration
+GET https://<IPS_TENANT>.accounts.ondemand.com/ips/service/ProvisioningService/v2/Systems/<SYSTEM_ID>
+
+# List provisioning job history (read status only; does not trigger a job)
+GET https://<IPS_TENANT>.accounts.ondemand.com/ips/service/ProvisioningService/v2/Systems/<SYSTEM_ID>/Jobs
+
+# Get a specific job run result (read-only)
+GET https://<IPS_TENANT>.accounts.ondemand.com/ips/service/ProvisioningService/v2/Jobs/<JOB_ID>
+```
+
+### BTP CLI — trust and role collection (read-only)
+
+```bash
+# List trust configurations for a subaccount
+btp list security/trust --subaccount <SUBACCOUNT_ID>
+
+# Get details of a specific trust configuration
+btp get security/trust <TRUST_CONFIG_NAME> --subaccount <SUBACCOUNT_ID>
+
+# List all role collections in a subaccount
+btp list security/role-collection --subaccount <SUBACCOUNT_ID>
+
+# Get a role collection with its role assignments
+btp get security/role-collection "<ROLE_COLLECTION_NAME>" --subaccount <SUBACCOUNT_ID>
+```
+
+### XSUAA API (read-only, GET only)
+
+```bash
+# List all role collections in the XSUAA instance
+GET <XSUAA_URL>/sap/rest/authorization/v2/rolecollections
+
+# Get a specific role collection with role template assignments
+GET <XSUAA_URL>/sap/rest/authorization/v2/rolecollections/<ROLE_COLLECTION_NAME>
+
+# List all scopes defined in the XSUAA instance
+GET <XSUAA_URL>/sap/rest/authorization/v2/apps/<CLIENT_ID>/scopes
+
+# List all role templates defined for an application
+GET <XSUAA_URL>/sap/rest/authorization/v2/apps/<CLIENT_ID>/roleTemplates
+```
+
+## Discovery workflow
+
+1. **Confirm authorization gate**
+   - Confirm with the user that live read-only access is authorized for this session.
+   - Confirm credential scope is viewer/auditor/read-only API user role only.
+   - Confirm target system and scope (IAS tenant, IPS tenant, BTP subaccount, XSUAA instance).
+
+2. **Select discovery scope**
+   - Identify which identity and trust layer(s) are in scope: IAS applications / IAS corporate IdP federation / IPS connectors / XSUAA role collections / BTP trust configurations.
+   - Select the minimum command set needed.
+
+3. **Execute read-only commands**
+   - Run only allowed command patterns above.
+   - Log every command with timestamp.
+   - Redact credential values, access tokens, and personal data beyond audit necessity before logging.
+
+4. **Structure evidence**
+   - Organize output by resource type and identity domain.
+   - Label all data as `live evidence` with command and timestamp.
+
+5. **Return output** per the output contract below.
+
+## Output contract
+
+Return:
+
+1. Discovery scope (what identity and trust data was enumerated and why)
+2. Authorization gate confirmation (role confirmed read-only: yes/no)
+3. Command log (every command, timestamp, summary of output, redactions applied)
+4. Structured evidence (resources enumerated, organized by identity domain: IAS / IPS / XSUAA / BTP trust)
+5. Redaction log (what was redacted and why)
+6. Next step (how this evidence feeds into the downstream advisory: IAM review, SoD assessment, compliance audit)
+7. Escalation trigger (any forbidden action encountered, any unexpected write attempt by the tool, or any personal data scope requiring review)

package/skills/sap/sap-live-readonly-landscape-discovery/SKILL.md

@@ -0,0 +1,135 @@
+---
+name: sap-live-readonly-landscape-discovery
+description: Enumerate and export SAP BTP and S/4HANA landscape configuration using read-only list, get, describe, and export operations only. Use when read-only discovery of subaccounts, service instances, entitlements, destinations, ABAP system landscape objects, or transport routes is needed as evidence for advisory, audit, or compliance purposes. Requires pre-authorized read-only credentials. Never creates, updates, deletes, deploys, assigns, rotates, imports, or triggers any change.
+allowed-tools: Read Grep Glob WebSearch WebFetch Bash
+metadata:
+  author: "github: Raishin"
+  version: "0.1.0"
+  updated: "2026-06-19"
+  category: platform
+  lifecycle: experimental
+  execution_tier: read-only-runtime
+---
+
+# SAP Live Read-Only Landscape Discovery
+
+## Purpose
+
+Enumerate SAP BTP and S/4HANA landscape configuration using strictly read-only operations to produce structured evidence for advisory, audit, compliance, or architecture review purposes. Every action taken by this skill must appear on the allowed-actions list below. This skill never changes state.
+
+## When to use
+
+Use this skill when the user needs to:
+
+- list BTP subaccounts, directories, entitlements, service instances, service bindings, or destinations,
+- describe ABAP system landscape objects (RFC destinations, transport routes, system definitions) in read-only mode,
+- export landscape configuration as structured evidence for a clean core review, transport planning, compliance audit, or architecture assessment,
+- enumerate trust configurations, identity providers, or role collections in read-only mode,
+- gather landscape facts needed as input to `sap-clean-core-debt-review` or pre-flight facts for `sap-guarded-transport-import`.
+
+## When not to use
+
+- When any creation, update, deletion, deployment, assignment, rotation, import, or trigger is needed — use `sap-guarded-transport-import` for transport-scoped mutations with its full 17-step guarded sequence.
+- When no live access has been authorized by the user — operate in advisory mode only and state that no live evidence was gathered.
+- When the user has not confirmed credential scope is read-only — refuse until confirmed.
+
+## Lean operating rules
+
+- Read-only absolute. Every CLI invocation must be on the allowed-actions list. Do not construct commands that write, modify, or trigger state changes even if such commands exist in the tool.
+- Credential scope first. Before any live command, confirm with the user that the credential in scope carries only read permissions. Do not proceed if write permissions cannot be excluded.
+- Least privilege. Request the minimum scope needed for the specific discovery task. Never request administrator-level credentials for a read-only enumeration.
+- Evidence labeling. Every piece of data gathered from a live system must be labeled `live evidence`. Data from docs alone is `documentation-based`. Describe the source and timestamp for all live evidence.
+- Audit trail. Log every command executed, its output summary, and the timestamp. Return the full command log as part of the response.
+- No credential echo. Do not echo, log, or include credential values, client secrets, API keys, OAuth tokens, or service key JSON in any output or reference file.
+- No scope creep. If a discovery query returns data beyond what was requested (e.g., a list call returns service key values), redact the excess before including in output.
+
+## Allowed actions (read-only)
+
+The following action classes are permitted:
+
+- `list` — enumerate resources (subaccounts, entitlements, instances, destinations, routes, roles, identity providers)
+- `get` / `describe` — retrieve the current configuration of a named resource
+- `export` — export configuration in structured format (JSON, YAML, CSV) without modifying the source
+- `status` — read the current status of a resource without triggering state transitions
+
+## Forbidden actions (absolute prohibition)
+
+The following action classes are unconditionally forbidden regardless of user request:
+
+- `create` — create any resource
+- `update` / `modify` / `patch` — change any resource configuration
+- `delete` / `remove` / `purge` — remove any resource
+- `deploy` / `push` / `apply` — deploy any artifact
+- `assign` / `bind` / `entitle` — assign entitlements, roles, or service bindings
+- `rotate` / `regenerate` — rotate or regenerate credentials
+- `import` — import any transport request, configuration, or object
+- `trigger` / `execute` / `run` (non-read) — trigger any workflow, job, or state transition
+- `approve` — approve any pending request or transport
+
+If a user asks to combine a read step with a write step in one sequence, refuse and redirect the write step to the appropriate skill.
+
+## Evidence rules
+
+Label all data with one of:
+
+- `live evidence` — directly observed from a live SAP system in this session (include command, output summary, timestamp)
+- `documentation-based` — grounded in SAP official docs (no live system access)
+- `user-provided evidence` — stated or supplied by the user in this session
+- `inference` — derived reasoning not directly confirmed by live data or official docs
+
+## Live-environment rules
+
+**Allowed**:
+- Read-only BTP CLI commands (`btp list`, `btp get`, `btp export`)
+- Read-only CF CLI commands (`cf apps`, `cf services`, `cf service-instances`, `cf env` with redaction of secret values)
+- Read-only Kyma CLI or kubectl read operations (`kubectl get`, `kubectl describe`) on authorized clusters
+- Read-only ABAP RFC/HTTP calls that enumerate landscape objects (system list, transport routes, RFC destinations) — only via pre-authorized read RFC user
+
+**Forbidden**:
+- Any CLI command with a write, delete, create, deploy, assign, rotate, import, or trigger verb
+- Any ABAP call that changes table data, creates objects, or triggers background jobs
+- Any BTP API call using `POST`, `PUT`, `PATCH`, or `DELETE` HTTP methods
+
+**Least-privilege credential rules**:
+- BTP CLI: use a subaccount viewer or global account viewer role only
+- CF: use SpaceAuditor or OrgAuditor role; never SpaceDeveloper or OrgManager for discovery
+- Kyma/kubectl: use a read-only ClusterRole or namespaced Role bound to `get`, `list`, `watch` verbs only
+- ABAP: use a display-only user (authorization objects S_TCODE limited to display transactions, no S_DEVELOP change authorization)
+
+**Approval gate**:
+Before executing any live command, confirm:
+1. The user has authorized live read-only access for this session.
+2. The credential in scope is confirmed read-only (viewer/auditor role or equivalent).
+3. The target system and scope are explicitly identified by the user.
+
+**Rollback**: This skill makes no changes; rollback is not applicable. However, if a command unexpectedly triggers a state change (e.g., a CLI bug or misconfigured tool), stop immediately and escalate to the user without continuing.
+
+**Post-change / post-discovery**:
+- Return a command log with all commands executed and a summary of evidence gathered.
+- Redact any credential values, service keys, or sensitive tokens from output.
+- Label all gathered data as `live evidence` with source command and timestamp.
+
+**Audit evidence**:
+- Every response that includes live evidence must include the full command log.
+- Audit evidence format: `[COMMAND] [TIMESTAMP_UTC] [SYSTEM] [SUMMARY_OF_OUTPUT]`
+
+## References
+
+Load only when needed:
+
+- [Workflow and output contract](references/workflow-and-output.md) — discovery workflow, command patterns, output format.
+- [Safety checklist](references/safety-checklist.md) — non-negotiables, forbidden action verification, credential rules.
+- [Official sources](references/official-sources.md) — SAP BTP CLI, CF CLI, Kyma, ABAP landscape docs.
+- [Live environment access](references/live-environment-access.md) — credential setup, role requirements, audit log format, redaction rules.
+
+## Response minimum
+
+Return, at minimum:
+
+- **Problem classification**: what landscape data is needed and why.
+- **Evidence used**: live evidence (with command log) / documentation-based / user-provided / inference.
+- **Risk level**: none — this skill is read-only.
+- **Recommended action**: which list/get/describe commands to run and in what order.
+- **Refusal / escalation triggers**: refuse if any requested action is on the forbidden list; escalate to the appropriate skill.
+- **Business impact**: what decisions depend on this landscape data; what is the cost of incomplete discovery.
+- **Next verification step**: confirm credential scope with the user before the first live command.

package/skills/sap/sap-live-readonly-landscape-discovery/agents/openai.yaml

@@ -0,0 +1,14 @@
+interface:
+  display_name: "SAP Live Read-Only Landscape Discovery"
+  short_description: "Enumerate SAP BTP and S/4HANA landscape configuration using read-only list, get, describe, and export operations only — no state changes"
+  default_prompt: "Use $sap-live-readonly-landscape-discovery to enumerate SAP landscape configuration in read-only mode. Confirm credential scope is read-only (viewer/auditor role) before the first live command. Use only list/get/describe/export operations. Log every command. Redact all credential values from output. Refuse any create/update/delete/deploy/assign/rotate/import/trigger request."
+dependencies:
+  tools:
+    - type: "cli"
+      value: "btp"
+      description: "SAP BTP CLI for read-only subaccount, entitlement, service instance, and destination enumeration — must be authenticated with viewer role credentials only"
+    - type: "cli"
+      value: "cf"
+      description: "Cloud Foundry CLI for read-only app, service, and environment enumeration — must use SpaceAuditor or OrgAuditor role only"
+policy:
+  allow_implicit_invocation: false

package/skills/sap/sap-live-readonly-landscape-discovery/metadata.json

@@ -0,0 +1,34 @@
+{
+  "id": "sap-live-readonly-landscape-discovery",
+  "name": "SAP Live Read-Only Landscape Discovery",
+  "type": "skill",
+  "provider": "sap",
+  "harnesses": [
+    "claude-code",
+    "codex",
+    "cursor",
+    "gemini",
+    "kiro",
+    "other"
+  ],
+  "summary": "Enumerate SAP BTP subaccounts, entitlements, service instances, destinations, and ABAP landscape objects using read-only list/get/describe/export operations. Produces structured audit evidence. Never creates, updates, deletes, deploys, assigns, rotates, imports, or triggers changes.",
+  "source_type": "original",
+  "category": "platform",
+  "official_docs": [
+    "https://help.sap.com/docs/btp/btp-cli-command-reference/btp-cli-command-reference",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/account-administration-using-sap-btp-command-line-interface-btp-cli",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/managing-entitlements-and-quotas-using-the-btp-cli",
+    "https://help.sap.com/docs/cloud-foundry/sap-cloud-foundry-command-line-interface/cf-command-reference",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/destinations",
+    "https://help.sap.com/docs/connectivity/sap-btp-connectivity-cf/destination-service-rest-api",
+    "https://help.sap.com/docs/btp/sap-business-technology-platform/sap-authorization-and-trust-management-service-in-the-cloud-foundry-environment",
+    "https://help.sap.com/docs/SAP_S4HANA_CLOUD/e5522a8a7b174979/3e56cde2e1044df5b5f3a5ecc8e59d27.html"
+  ],
+  "security_notes": "Read-only enforced. Never request or accept write-capable credentials. Use viewer/auditor roles only (BTP subaccount viewer, CF SpaceAuditor/OrgAuditor, kubectl read-only ClusterRole, ABAP display user). Redact all credential values, service keys, and OAuth tokens from output. Log every command executed. Refuse any request that maps to a create/update/delete/deploy/assign/rotate/import/trigger action.",
+  "last_verified": "2026-06-19",
+  "path": "skills/sap/sap-live-readonly-landscape-discovery",
+  "author": "github: Raishin",
+  "version": "0.1.0",
+  "lifecycle": "experimental",
+  "execution_tier": "read-only-runtime"
+}