sap-dependency-security — Claude Code skill: what it does & setup
Guards SAP projects against supply chain risks and enforces strict executable rules for MCP servers. Useful when upgrading libraries in SAP CAP or BTP.
npx skills add secondsky/sap-skills --skill sap-dependency-security -a claude-codeWhat sap-dependency-security does
This skill configures package manager rules across npm, Bun, pnpm, Yarn, or Deno. It restricts dangerous lifecycle scripts and sets publication cooldown periods. You can run an interactive setup questionnaire or load recommended defaults with a seven-day release delay.
The dedicated SAP Development Mode enforces strict boundaries. It raises package cooldown to 14 days and requires exact version pinning for all MCP tooling inside .mcp.json. Floating @latest tags are rejected. Local forks, such as SAC MCP servers, require a hard-pinned commit SHA.
Skipping exact pins breaks drift validation when executing npm run validate:mcp-security. The skill also builds automation profiles for Dependabot or Renovate with defined merge schedules.
What it helps with
- block post-install lifecycle scripts across package managers
- enforce package release cooldowns against early zero-days
- lock down MCP executable versions inside
.mcp.json - prepare Dependabot or Renovate configs with scheduled review rules
Example prompts for the agent
- Review .mcp.json and replace any floating latest tags with exact versions
- Configure pnpm security policies with a 14-day package cooldown period
- Generate a secure dependabot.yml configuration for an SAP CAP project
How to install sap-dependency-security
1Skills CLI (Vercel)
npx skills add secondsky/sap-skills --skill sap-dependency-security -a claude-code2Manually: put the files in place
~/.claude/skills/sap-dependency-security/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/sap-dependency-security/
1Skills CLI (Vercel)
npx skills add secondsky/sap-skills --skill sap-dependency-security -a codex2Manually: put the files in place
.agents/skills/sap-dependency-security/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add secondsky/sap-skills --skill sap-dependency-security -a cursor2Manually: put the files in place
.cursor/skills/sap-dependency-security/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install secondsky/sap-skills sap-dependency-security2Manually: put the files in place
.github/skills/sap-dependency-security/SKILL.md1Skills CLI (Vercel)
npx skills add secondsky/sap-skills --skill sap-dependency-security -a gemini-cli2Platform CLI
gemini skills install https://github.com/secondsky/sap-skills --path plugins/sap-dependency-security/skills/sap-dependency-securityManually: put the files in place
.devin/skills/sap-dependency-security/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add secondsky/sap-skills --skill sap-dependency-security -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about sap-dependency-security
How to install sap-dependency-security in Claude Code?
Run npx skills add secondsky/sap-skills --skill sap-dependency-security -a claude-code in your terminal.
What does sap-dependency-security do?
It prevents supply-chain compromise in SAP environments by restricting untrusted lifecycle scripts and locking down executable MCP servers.
What does SAP Development Mode enforce?
It mandates a 14-day cooldown for dependencies and bans floating package tags like @latest in .mcp.json. Local MCP servers must pin specific source commits.
