Skills Explorer Add Skills

planner

An agent skill by digitalocean-labs, from digitalocean-labs/do-app-platform-skills. Tags: deployment, digitalocean, planning, project-management, strategy.

What it does

Generate staged project plans from design through deployment. Use when planning App Platform projects, breaking complex deployments into resumable stages, or tracking multi-step infrastructure setup.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add digitalocean-labs/do-app-platform-skills --skill planner

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/digitalocean-labs/do-app-platform-skills
cp -r do-app-platform-skills/skills/planner ~/.claude/skills/planner

Safety box score

Grade C, moderate risk: 44 of 100 risk points, rated 2026-09-26. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a planning/deployment helper that creates staged `Plan/` artifacts and tells the agent to validate builds with `doctl app dev build`, Docker, and sometimes `git push`/GitHub Actions. The main risks are secret handling (`.env.secrets`), remote network activity during build/deploy validation, and the ability to trigger deployments by pushing code.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution2 (moderate)It instructs the agent to run real commands such as `doctl app dev build`, `docker info`, `curl http://localhost:PORT/health`, and `git push`, which is bounded but still active shell execution.
Network access2 (moderate)The workflow contacts remote services via `doctl app dev build --app <APP_ID>` and can trigger GitHub Actions deployments with `git push`, so code and build context may leave the machine.
Filesystem reach2 (moderate)It creates and updates project files like `Plan/`, `.do/dev-config.yaml`, and `.env.secrets`, and reads `.do/app.yaml`/`.env.local`; this is mostly project-scoped but includes sensitive local artifacts.
Secrets & credentials3 (high)The skill explicitly says captured values such as IDs, passwords, and URLs go into `.env.secrets` and that AI assistants read it to resume, so it intentionally handles credential-bearing files.
Privilege & persistence0 (none)There is no use of `sudo`, global installs, system services, shell startup edits, or other privilege changes in the files provided.
Instruction hijack surface0 (none)I found no instructions to ignore higher-priority rules, follow hidden remote content, or otherwise manipulate the agent’s instruction hierarchy.
Irreversible actions2 (moderate)For Tier 3, it says deployment must happen via `git push` and GitHub Actions, which can initiate a production deploy once pushed, though a human still performs the push.
Transparency0 (none)The reviewed files are plain markdown with visible commands and no binaries, encoded blobs, or dynamically fetched hidden code.

Before installing

Rated 2026-09-26 by an automated review of 4 files from the skill's repository.

Source

Repository
digitalocean-labs/do-app-platform-skills (all skills from this repository)
Path
skills/planner/SKILL.md
Branch
main
Collection
do-app-platform
Updated
2026-09-21