app-platform-troubleshooting

An agent skill by digitalocean-labs, from digitalocean-labs/do-app-platform-skills. Tags: app-platform, debugging, digitalocean, logs, performance, troubleshooting.

What it does

Debug running App Platform applications by accessing containers, analyzing logs, running diagnostics, and applying fixes. Use when apps fail to deploy, crash at runtime, have connectivity issues, or need performance diagnosis.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add digitalocean-labs/do-app-platform-skills --skill app-platform-troubleshooting

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/digitalocean-labs/do-app-platform-skills
cp -r do-app-platform-skills/skills/troubleshooting ~/.claude/skills/app-platform-troubleshooting

Safety box score

Grade D, elevated risk: 63 of 100 risk points, rated 2026-10-17. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill troubleshoots DigitalOcean App Platform apps by opening shells in running containers, pulling logs, running diagnostics, and sometimes uploading/running fixes or changing deployment settings. The main risks are secret exposure, arbitrary command execution inside app containers, outbound network access to third-party and DigitalOcean endpoints, and potentially disruptive lifecycle actions like restart, redeploy, archive, or delete.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	3 (high)	It directly runs commands and code in app containers via `app.exec(...)`, and even uploads then executes scripts with `chmod +x /tmp/diagnostic.sh && /tmp/diagnostic.sh`.
Network access	3 (high)	It fetches logs and health checks over the network with `doctl apps logs ...` and `curl ...`, and it also pulls an opaque debug image from GHCR (`ghcr.io/.../debug-python:latest`).
Filesystem reach	2 (moderate)	It reads and writes application files and temp files inside the container, including `app.filesystem.read_file("/app/config.py")`, `write_file("/app/config.py", new_content)`, and uploads to `/tmp/diagnostic.sh`.
Secrets & credentials	3 (high)	It explicitly inspects sensitive env vars and credentials with commands like `env \| sort`, `echo $DATABASE_URL`, `echo $KAFKA_PASSWORD`, and recommends collecting `doctl apps get ... -o json` plus logs.
Privilege & persistence	1 (low)	It does not require sudo or service registration, but it does alter the local environment with `uv pip install do-app-sandbox` and can modify shell behavior via `export PS1=...`.
Instruction hijack surface	0 (none)	I found no instructions to ignore higher-level rules, follow remote content, hide actions, or otherwise behave like prompt injection.
Irreversible actions	2 (moderate)	It can restart, redeploy, update specs, archive/unarchive apps, and even delete the debug app (`doctl apps restart`, `create-deployment`, `update`, `delete`), which can change availability.
Transparency	2 (moderate)	It depends on opaque external components and an unpinned remote image (`ghcr.io/bikramkgupta/debug-python:latest`, `do_app_sandbox`), so some runtime behavior is not reviewable here.

Before installing

Review `reference/live-troubleshooting.md` for the `app.exec` and upload/write-file paths before use.
Decide whether exposing `DATABASE_URL`, `KAFKA_PASSWORD`, and app logs is acceptable for your environment.
Pin or replace the external debug image instead of using `ghcr.io/bikramkgupta/debug-python:latest` if supply-chain review matters.
Test on a non-production app first, since the skill can restart, redeploy, archive, and delete resources.

Rated 2026-10-17 by an automated review of 8 files from the skill's repository.

Source

Repository: digitalocean-labs/do-app-platform-skills (all skills from this repository)
Path: skills/troubleshooting/SKILL.md
Branch: main
Collection: do-app-platform
Updated: 2026-09-21

debugging-wizard — Parses error messages, traces execution flow through stack traces, correlates log entries to identify failure points.
app-platform-router — Routes DigitalOcean App Platform tasks to specialized sub-skills.
agents-debug — Use when your agent or environment is broken — wrong answers, errors, timeouts, tool failures, or CLI issues. Reads traces and logs to diagnose root causes.
aws-observability — Builds, configures, debugs, and optimizes AWS observability with CloudWatch (Log Insights, Metrics, Alarms, Dashboards, EMF), X-Ray, CloudTrail.
principle-fix-root-causes — Apply when debugging.
debugging-lambda-timeouts — Debugs AWS Lambda function timeout failures by systematically analyzing function configuration, CloudWatch logs and metrics, VPC/networking, cold starts.