app-platform-networking
An agent skill by digitalocean-labs, from digitalocean-labs/do-app-platform-skills. Tags: access-control, digitalocean, networking, routing, vpc, web.
What it does
Configure domains, routing, CORS, VPC, static IPs, and inter-service communication for DigitalOcean App Platform. Use when setting up custom domains, subdomain routing, cross-origin API access, or secure database connectivity.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add digitalocean-labs/do-app-platform-skills --skill app-platform-networkingOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/digitalocean-labs/do-app-platform-skills
cp -r do-app-platform-skills/skills/networking ~/.claude/skills/app-platform-networkingSafety box score
Grade B, low risk: 23 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill configures DigitalOcean App Platform networking: domains/DNS, ingress routing, CORS, VPC trusted sources, and dedicated egress. Its main risk is broad live-traffic and connectivity changes, including redirects, firewall rules, and static outbound IPs that can affect production availability and external access.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 1 (low) | The files include shell examples like `doctl`, `jq`, `dig`, and `psql`, but no shipped scripts or code that is executed automatically. |
| Network access | 2 (moderate) | Its purpose is to change public DNS, ingress routing, CORS, VPC trust rules, and egress behavior, with commands such as `doctl databases firewalls append` and nameserver/A-record changes. |
| Filesystem reach | 0 (none) | The skill does not read, write, or delete local files outside the app spec examples it documents. |
| Secrets & credentials | 1 (low) | It handles private database connection URIs and secret env vars such as `DATABASE_PRIVATE_URL` and `type: SECRET`, but it does not request browser sessions or stored tokens. |
| Privilege & persistence | 0 (none) | There is no `sudo`, service registration, shell profile editing, or global system change in the skill files. |
| Instruction hijack surface | 0 (none) | The docs do not instruct the agent to ignore safeguards, follow remote instructions, hide actions, or adopt deceptive personas. |
| Irreversible actions | 2 (moderate) | It can make externally visible changes like redirects, domain routing, trusted-source rules, and dedicated egress, but those changes are still applied through user-approved App Platform config. |
| Transparency | 0 (none) | All shipped content is readable markdown; there are no binaries, bundled installers, or decoded-at-runtime blobs. |
Before installing
- Read `reference/ingress-routing.md` and confirm you are comfortable changing live routing/redirects for production domains.
- Read `reference/static-ips-egress.md` and verify you accept the cost and irreversibility of dedicated egress IPs.
- Test the spec in a non-production app with `doctl apps spec validate .do/app.yaml` before applying it.
- Check how your databases are trusted: VPC CIDR rules vs `app:$APP_ID`, especially if you will use private connection strings.
Rated 2026-10-14 by an automated review of 8 files from the skill's repository.
Source
- Repository
- digitalocean-labs/do-app-platform-skills (all skills from this repository)
- Path
- skills/networking/SKILL.md
- Branch
- main
- Collection
- do-app-platform
- Updated
- 2026-09-21
Related skills
- connecting-vpcs-with-peering — Establishes VPC peering connections between two VPCs for direct private network connectivity.
- app-platform-router — Routes DigitalOcean App Platform tasks to specialized sub-skills.
- postgres — Configure DigitalOcean Managed Postgres with bindable variables or schema isolation.
- spaces — Configure DigitalOcean Spaces (S3-compatible object storage) for App Platform apps.
- aws-auth — Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries.
- expo-router — Framework (OSS). Navigation and routing for Expo Router.