app-platform-sandbox
An agent skill by digitalocean-labs, from digitalocean-labs/do-app-platform-skills. Tags: automation, digitalocean, multi-agent, sandbox, security, testing.
What it does
Create and manage isolated container sandboxes for AI agent code execution. Use when you need ephemeral environments to run untrusted code, execute agent workflows, or test in isolation. NOT for debugging existing apps (use troubleshooting skill).
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add digitalocean-labs/do-app-platform-skills --skill app-platform-sandboxOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/digitalocean-labs/do-app-platform-skills
cp -r do-app-platform-skills/skills/sandbox ~/.claude/skills/app-platform-sandboxSafety box score
Grade C, moderate risk: 33 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill provisions DigitalOcean App Platform sandboxes and lets an agent execute shell commands, install packages, stream output, and expose ports inside them. The main risks are broad code execution, outbound network exposure/public URLs, and automated creation/deletion of cloud containers that can incur cost.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 3 (high) | Level 3 because the core API is arbitrary command execution (`sandbox.exec(cmd)` and `sandbox.exec_stream(cmd)`), and the docs explicitly say it is for environments that `run untrusted code`. |
| Network access | 2 (moderate) | Level 2 because sandboxes can reach the internet (`Network egress | Direct internet` in `reference/positioning.md`) and can publish public preview URLs via `sandbox.expose_port(3000)` in `reference/service-mode.md`. |
| Filesystem reach | 1 (low) | Level 1 because it reads/writes files inside the sandbox and can upload/download to local paths like `./local-results.json`, but it does not target host system paths or dotfiles. |
| Secrets & credentials | 1 (low) | Level 1 because it assumes an authenticated `doctl` session (`doctl auth whoami`) and a DigitalOcean account, but it does not directly read tokens, keychains, or password stores. |
| Privilege & persistence | 0 (none) | Level 0 because there is no sudo, service registration, shell startup modification, or other host-level privilege change in the shipped files. |
| Instruction hijack surface | 0 (none) | Level 0 because the docs do not tell the agent to ignore safeguards, follow hidden remote instructions, or conceal behavior. |
| Irreversible actions | 2 (moderate) | Level 2 because it can create, acquire, hibernate, and delete cloud sandboxes/pools (`SandboxManager`, `acquire()`, `delete()`), which has external side effects and cost impact even though it stays within the user's account boundary. |
| Transparency | 0 (none) | Level 0 because all shipped files are readable markdown; there are no binaries, base64 blobs, or decoded-at-runtime scripts. |
Before installing
- Read `reference/service-mode.md` before using `expose_port()`; it publishes a public URL.
- Run `doctl auth whoami` in the intended DigitalOcean account before any sandbox creation.
- Test the workflow once in a scratch sandbox and verify `sandbox.delete()` is always called in `finally` blocks.
- Check any `download_file(..., "./...")` paths for accidental overwrites in your local project directory.
Rated 2026-10-20 by an automated review of 7 files from the skill's repository.
Source
- Repository
- digitalocean-labs/do-app-platform-skills (all skills from this repository)
- Path
- skills/sandbox/SKILL.md
- Branch
- main
- Collection
- do-app-platform
- Updated
- 2026-09-21
Related skills
- chaos-engineer — Designs chaos experiments, creates failure injection frameworks, and facilitates game day exercises for distributed systems — producing runbooks.
- address-sanitizer — Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests.
- agentic-actions-auditor — Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex.
- agents-build — Use to extend an existing agent project with memory, app integration, VPC, multi-agent, migration, model, browser, code interpreter, payments.
- agents-connect — Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies.
- atheris — Sets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer.