Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/digitalocean-labs/do-app-platform-skillsnpx agentmods add skills/digitalocean-labs/do-app-platform-skills/plannerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/digitalocean-labs/do-app-platform-skills/planner)<a href="https://agentmods.dev/skills/digitalocean-labs/do-app-platform-skills/planner"><img src="https://agentmods.dev/badge/skills/digitalocean-labs/do-app-platform-skills/planner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/digitalocean-labs/do-app-platform-skills/planner"><img src="https://agentmods.dev/badge/skills/digitalocean-labs/do-app-platform-skills/planner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 47 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01776 |
| Opus 5 | $0.00016 | $0.00888 |
| Sonnet 5 | $0.00007 | $0.00355 |
| Haiku 4.5 | $0.00003 | $0.00178 |
Grade A, and why
planner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 244 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Planner Skill
Generate staged project plans that break complex projects into manageable, resumable steps - from initial design through coding, testing, to cloud deployment.
Tip: For a complete overview of all available skills, see the root SKILL.md.
Greenfield vs Brownfield Detection
| Scenario | Detection | Behavior |
|---|---|---|
| Greenfield | No Dockerfiles, no .do/app.yaml |
Create artifacts from scratch |
| Brownfield | Dockerfiles and/or .do/app.yaml exist |
Review, validate, enhance existing |
The AI assistant automatically detects the project state. Don't recreate valid artifacts. The critical validation gate is doctl app dev build — if that passes, artifacts are correct.
Why Staged Deployment?
Complex App Platform deployments fail when executed monolithically:
- Blind deployment fails - Deploying without infrastructure prep results in cryptic errors
- Context is lost - Credentials, cluster IDs, and progress are forgotten between sessions
- Debugging is harder - When everything deploys at once, it's unclear which component failed
- Resumability is poor - Starting over wastes time; partial progress isn't tracked
Build Locally First
CRITICAL: Always validate builds locally before cloud deployment.
doctl app dev build # Build using local app spec
doctl app dev build --app <APP_ID> # Build using existing deployed app
doctl app dev build --env-file .env # Build with environment overrides
| Build Location | Feedback Time | Cost of Failure |
|---|---|---|
| Cloud | 5-10 minutes | Wasted cycle, confusing logs |
| Local | 30-60 seconds | Immediate fix, clear errors |
Full details: See build-local-first.md
Tier Classification
Detection from User Description
| User Mentions | Tier |
|---|---|
| "static", "frontend only", "no database", "SPA" | Tier 1 |
| "PostgreSQL", "MySQL", "database", "API + frontend" | Tier 2 |
| "Kafka", "OpenSearch", "workers", "event-driven", "microservices" | Tier 3 |
What ships with it
18 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- README.md 1.2 KB
- reference/artifact-storage.md 1.8 KB
- reference/build-local-first.md 2.0 KB
- templates/local/01-local-design.md.template 733 B
- templates/local/02-local-coding.md.template 1.8 KB
- templates/local/03-local-testing.md.template 2.6 KB
- templates/tier-1-simple/04-cloud-deploy.md.template 1.3 KB
- templates/tier-1-simple/05-cloud-validate.md.template 1.2 KB
- templates/tier-2-database/04-cloud-database.md.template 944 B
- templates/tier-2-database/05-cloud-config.md.template 1.2 KB
- templates/tier-2-database/06-cloud-deploy.md.template 1.6 KB
- templates/tier-2-database/07-cloud-validate.md.template 1.1 KB
- templates/tier-3-complex/04-cloud-database-clusters.md.template 1.9 KB
- templates/tier-3-complex/05-cloud-config-users-topics.md.template 2.2 KB
- templates/tier-3-complex/06-cloud-debug-validation.md.template 3.6 KB
- templates/tier-3-complex/07-cloud-secrets-cicd.md.template 2.5 KB
- templates/tier-3-complex/08-cloud-deploy-production.md.template 3.2 KB
- templates/tier-3-complex/09-cloud-end-to-end.md.template 2.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 244 lines · 33 tokens per session scan A 53388ae03f86
planner is a skill published in the GitHub repository digitalocean-labs/do-app-platform-skills (36 stars, last pushed 2d ago), licensed MIT. It adds 33 tokens to every session and 1,776 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
digitalocean
Use when deploying or operating a workload on DigitalOcean — Droplet vs App Platform vs Functions, doctl, app spec YAML, Managed Postgres/MySQL/Valkey on the VPC, S3-compatible Spaces + CDN. NOT host-agnostic CI/CD or rollback strategy (that is deployment), NOT a bare Hetzner VPS (that is hetzner), NOT another managed…
piggyback-hosting
Hosting-Muster, um eine lokal gebaute Anwendung (eigene Datenbank, eigener API-Key, In-Process-State) sicher hostbar zu machen, ohne Nutzerverwaltung zu bauen. Kernzug — der Host speichert nichts, der Browser des Besuchers speichert alles — sodass Pro-Besucher-Accounts, Zugriffsprüfungen und Löschfristen…
netlify-deploy
Deploy web projects to Netlify using the Netlify CLI (npx netlify). Use when the user asks to deploy, host, publish, or link a site/repo on Netlify, including preview and production deploys.
ecspresso
ECS deployment tool - deploy, manage, and troubleshoot ECS services.
securing-helm-chart-deployments
Secure Helm chart deployments by validating chart integrity, scanning templates for misconfigurations, and enforcing security contexts in Kubernetes releases.
pinme-r2
Use when a PinMe Cloudflare Worker needs R2 object storage, including secure file or image upload, streaming download, metadata lookup, deletion, listing, Range requests, or R2+D1 coordination. Guides AI to use PinMe's automatically injected env.R2 binding without R2 credentials or manual Wrangler configuration.