SAP Integration Suite

Integration and automation for SAP ABAP, HANA, and S/4HANA via data extraction, RFC/BAPI calls, API integration, ABAP code generation, and workflow automation.

This skill appears to be a genuine SAP integration tool, but review these before installing: - Missing files: SKILL.md lists additional scripts (sap_report_generator.py, table_analyzer.py) that are not included — ask the publisher why and request complete sources. - Credentials: The Python scripts expect a JSON config containing SAP credentials (ashost, sysnr, client, user, passwd). The registry metadata did not declare these credentials — assume you must provide sensitive SAP credentials. Only supply minimal-privilege technical users and test against a non-production system first. - Native dependencies: pyrfc requires SAP's NW RFC SDK and native build steps; the skill provides no install instructions. Don't attempt to install pyrfc without following official guidance from SAP and your security team. - Data sensitivity: The scripts can read arbitrary SAP tables (RFC_READ_TABLE) and save them locally. Confirm data-handling policies, encryption-at-rest, and audit logging before extraction. - Verify provenance: source/homepage is unknown. Prefer skills with a verifiable publisher and a hosted repository; if you must use this, request the publisher's contact, provenance, and a signed release. If you proceed, run the code in an isolated environment, limit SAP account privileges, and review the full source (including any missing files) before granting access to production systems.

Type: OpenClaw Skill Name: sap-integration Version: 1.0.0 The skill bundle provides powerful capabilities for SAP system interaction, including executing arbitrary RFC function modules (`scripts/rfc_function_caller.py`) and extracting data from any SAP table (`scripts/sap_data_extractor.py`). While these capabilities align with the stated purpose of 'SAP system integration, data extraction, and automation', they represent a significant attack surface. An AI agent, if compromised or subjected to a sophisticated prompt injection, could be instructed to perform highly sensitive operations (e.g., user creation, data modification via RFC) or exfiltrate sensitive data (e.g., user credentials, financial records from arbitrary tables) from the connected SAP system. The scripts themselves do not contain explicit malicious intent like exfiltrating data to unauthorized external endpoints or installing backdoors, but the broad and unconstrained nature of the SAP access they enable makes the skill highly risky and thus classified as suspicious.