postgres

An agent skill by digitalocean-labs, from digitalocean-labs/do-app-platform-skills. Tags: access-control, database, digitalocean, postgresql, schema, troubleshooting.

What it does

Configure DigitalOcean Managed Postgres with bindable variables or schema isolation. Use when setting up databases, creating users, managing permissions, configuring multi-tenant schemas, or troubleshooting database connectivity on App Platform.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add digitalocean-labs/do-app-platform-skills --skill postgres

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/digitalocean-labs/do-app-platform-skills
cp -r do-app-platform-skills/skills/postgres ~/.claude/skills/postgres

Safety box score

Grade D, elevated risk: 60 of 100 risk points, rated 2026-09-24. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill manages DigitalOcean Managed Postgres through `doctl`, `psql`, and GitHub CLI flows. The main risks are secret handling (including plaintext credential output and GitHub Secret writes) and destructive database cleanup paths that can delete schemas, users, and connection pools.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It ships runnable shell/Python scripts that invoke `psql`, `gh`, and `doctl`, and `scripts/create_schema_user.py` has a direct `--execute` mode for running SQL.
Network access	2 (moderate)	The skill sends data to remote services via `doctl databases connection`, `doctl databases pool create`, and `gh secret set`, so credentials and DB state leave the machine to DigitalOcean/GitHub.
Filesystem reach	1 (low)	Local file writes are limited to optional generated artifacts such as `scripts/create_schema_user.py --output-dir`, which creates `db-setup.sql`, `db-users.sql`, and similar files in a caller-chosen directory.
Secrets & credentials	3 (high)	It handles live database passwords and repo secrets, including `gh secret set`, `DATABASE_URL`, and scripts that print credentials like `Password:` and `DB_PASSWORD=` to stdout.
Privilege & persistence	0 (none)	No sudo, services, shell startup files, or OS-wide settings are modified; it only uses existing CLIs and database permissions.
Instruction hijack surface	3 (high)	The skill explicitly advertises hands-free and confirmation-bypass paths such as `--skip-confirm` and `--confirm`, which let the agent act without human review.
Irreversible actions	3 (high)	It can create database users and secrets automatically, and it can also permanently drop schemas and owned objects, so the blast radius includes data destruction and account changes.
Transparency	0 (none)	All reviewed files are plain text source or docs; there are no binaries, decoded blobs, or unreviewable downloaded code.

Before installing

Read `scripts/cleanup_client.py` first; only use `--confirm` on a throwaway cluster.
Run `scripts/secure_setup.py` or `secure_setup.sh` in a scratch repo first, because they write GitHub Secrets.
Avoid terminals with shared logs when using `scripts/add_client.py` or `scripts/generate_connection_string.py`; they print credentials.
Use `scripts/create_schema_user.py --generate --output-dir <tempdir>` and review the SQL before ever trying `--execute`.

Rated 2026-09-24 by an automated review of 20 files from the skill's repository.

Source

Repository: digitalocean-labs/do-app-platform-skills (all skills from this repository)
Path: skills/postgres/SKILL.md
Branch: main
Collection: do-app-platform
Updated: 2026-09-21

managed-db-services — Configure DigitalOcean Managed MySQL, MongoDB, Valkey, Kafka, and OpenSearch for App Platform.
app-platform-networking — Configure domains, routing, CORS, VPC, static IPs, and inter-service communication for DigitalOcean App Platform.
app-platform-router — Routes DigitalOcean App Platform tasks to specialized sub-skills.
app-platform-troubleshooting — Debug running App Platform applications by accessing containers, analyzing logs, running diagnostics, and applying fixes.
spaces — Configure DigitalOcean Spaces (S3-compatible object storage) for App Platform apps.
amazon-aurora-postgresql — Amazon Aurora PostgreSQL — creates, modifies, and advises on Aurora PostgreSQL clusters specifically (PostgreSQL-compatible engine, Aurora serverless.