managed-db-services

An agent skill by digitalocean-labs, from digitalocean-labs/do-app-platform-skills. Tags: cloud, configuration, connectivity, database, digitalocean, troubleshooting.

What it does

Configure DigitalOcean Managed MySQL, MongoDB, Valkey, Kafka, and OpenSearch for App Platform. Use when setting up non-PostgreSQL databases, configuring trusted sources, or troubleshooting database connectivity.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add digitalocean-labs/do-app-platform-skills --skill managed-db-services

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/digitalocean-labs/do-app-platform-skills
cp -r do-app-platform-skills/skills/managed-db-services ~/.claude/skills/managed-db-services

Safety box score

Grade C, moderate risk: 35 of 100 risk points, rated 2026-10-15. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is documentation for provisioning and wiring DigitalOcean managed MySQL, MongoDB, Valkey, Kafka, and OpenSearch into App Platform. The main risks are cloud-account mutation (creating clusters/users/firewall rules/ACLs), handling bearer tokens and database passwords, and a few snippets that weaken access controls or write secret material to files inside containers.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It is meant to be followed as shell/API workflows (`doctl databases create`, `curl -X POST`, `exec "$@"`), so an agent using it will run commands and scripts, even though the skill itself ships no executable binaries.
Network access	2 (moderate)	The skill contacts DigitalOcean APIs and managed services over the network, e.g. `https://api.digitalocean.com/v2/databases/$CLUSTER_ID/users` and `https://api.digitalocean.com/v2/databases/$CLUSTER_ID/opensearch/acl`.
Filesystem reach	1 (low)	The only explicit writes are bounded, such as Kafka CA cert handling to `/tmp/kafka-ca.crt` in `reference/kafka.md`; it does not edit host dotfiles or arbitrary paths.
Secrets & credentials	2 (moderate)	It uses and exposes credentials in several places, including `Authorization: Bearer $DO_TOKEN`, `${db.PASSWORD}`, `KAFKA_PASSWORD`, and connection strings with embedded passwords.
Privilege & persistence	0 (none)	No `sudo`, global installs, service registration, shell startup edits, or other local privilege changes appear in the files.
Instruction hijack surface	0 (none)	I found no hidden text or instructions to ignore safeguards/follow remote content; the files are straightforward documentation.
Irreversible actions	2 (moderate)	Its purpose is to create and modify live cloud resources—clusters, users, topics, trusted-source rules, and ACLs—but it does not directly delete infrastructure or force irreversible publishing actions.
Transparency	0 (none)	All reviewed files are plain markdown with readable commands; there are no binaries, base64 blobs, or unpinned downloads.

Before installing

Read `reference/kafka.md` and `reference/opensearch.md` for the temp-file and trusted-sources changes they imply.
Use a throwaway DigitalOcean project/token first; this skill creates clusters and changes firewalls on your account.
Confirm you are okay with secrets appearing in env vars and connection strings such as `${db.PASSWORD}` and `Authorization: Bearer $DO_TOKEN`.
Run the `doctl` commands on a scratch cluster name before applying them to production resources.

Rated 2026-10-15 by an automated review of 7 files from the skill's repository.

Source

Repository: digitalocean-labs/do-app-platform-skills (all skills from this repository)
Path: skills/managed-db-services/SKILL.md
Branch: main
Collection: do-app-platform
Updated: 2026-09-21

postgres — Configure DigitalOcean Managed Postgres with bindable variables or schema isolation.
app-platform-router — Routes DigitalOcean App Platform tasks to specialized sub-skills.
app-platform-troubleshooting — Debug running App Platform applications by accessing containers, analyzing logs, running diagnostics, and applying fixes.
deployment — Deploy applications to DigitalOcean App Platform via GitHub Actions with proper environment management and secrets handling.
aws-compute — Provisions, scales, and operates Amazon EC2 virtual-machine workloads: instance-type selection (Graviton/Arm64, burstable T credits, GPU.
aws-containers — Builds and deploys containerized workloads on Elastic Kubernetes Service (EKS), Elastic Container Service (ECS), Fargate, and ECR (Elastic Container Registry).