Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/digitalocean-labs/do-app-platform-skillsnpx agentmods add skills/digitalocean-labs/do-app-platform-skills/spacesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/digitalocean-labs/do-app-platform-skills/spaces)<a href="https://agentmods.dev/skills/digitalocean-labs/do-app-platform-skills/spaces"><img src="https://agentmods.dev/badge/skills/digitalocean-labs/do-app-platform-skills/spaces/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/digitalocean-labs/do-app-platform-skills/spaces"><img src="https://agentmods.dev/badge/skills/digitalocean-labs/do-app-platform-skills/spaces.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.01748 |
| Opus 5 | $0.00019 | $0.00874 |
| Sonnet 5 | $0.00008 | $0.00350 |
| Haiku 4.5 | $0.00004 | $0.00175 |
Grade A, and why
spaces scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 218 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Spaces Skill
S3-compatible object storage for App Platform applications.
Tool Separation (Critical)
┌─────────────────────────────────────────────────────────────────┐
│ doctl: KEYS ONLY │ aws CLI: EVERYTHING ELSE │
│ • doctl spaces keys create│ • Bucket create/delete │
│ • doctl spaces keys list │ • Object upload/download │
│ • doctl spaces keys delete│ • CORS, logging, lifecycle │
└─────────────────────────────────────────────────────────────────┘
Why? doctl's Spaces support is limited to key management. Bucket operations require S3-compatible tools.
Quick Decision
┌─────────────────────────────────────────────────────────────────┐
│ What do you need to do with Spaces? │
└─────────────────────────────────────────────────────────────────┘
│
┌─────────────────────┼─────────────────────┐
│ │ │
Create key Create bucket Upload/download
or rotate set CORS/logging objects
│ │ │
▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌───────────────┐
│ doctl │ │ aws CLI │ │ aws CLI │
│ spaces keys │ │ s3api │ │ s3 cp/sync │
└───────────────┘ └───────────────┘ └───────────────┘
Prerequisites
doctl auth init # One-time DO API auth
aws --version # AWS CLI v2
jq --version # JSON processor
Quick Start
1. Set Environment
# Choose region matching your App Platform app (see shared/regions.yaml)
export DO_SPACES_REGION="syd1"
export DO_SPACES_ENDPOINT="https://${DO_SPACES_REGION}.digitaloceanspaces.com"
export APP_NAME="myapp"
export BUCKET="${APP_NAME}-uploads"
export DO_SPACES_KEY_NAME="${APP_NAME}-spaces-key"
2. Create Key (doctl)
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- README.md 1.7 KB
- reference/access-logging.md 7.5 KB
- reference/aws-cli-operations.md 7.3 KB
- reference/key-management.md 6.9 KB
- reference/sdk-configuration.md 2.7 KB
- reference/troubleshooting.md 9.0 KB
- scripts/_lib.sh 4.9 KB runs code
- scripts/bootstrap_app_spaces.sh 2.3 KB runs code
- scripts/enable_bucket_logging.sh 1.4 KB runs code
- scripts/rotate_spaces_key.sh 2.6 KB runs code
- scripts/view_access_logs.sh 2.3 KB runs code
- templates/bucket-logging.json 105 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 218 lines · 39 tokens per session scan A a4e702a132bb
spaces is a skill published in the GitHub repository digitalocean-labs/do-app-platform-skills (36 stars, last pushed 4d ago), licensed MIT. It adds 39 tokens to every session and 1,748 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
digitalocean
Use when deploying or operating a workload on DigitalOcean — Droplet vs App Platform vs Functions, doctl, app spec YAML, Managed Postgres/MySQL/Valkey on the VPC, S3-compatible Spaces + CDN. NOT host-agnostic CI/CD or rollback strategy (that is deployment), NOT a bare Hetzner VPS (that is hetzner), NOT another managed…
piggyback-hosting
Hosting-Muster, um eine lokal gebaute Anwendung (eigene Datenbank, eigener API-Key, In-Process-State) sicher hostbar zu machen, ohne Nutzerverwaltung zu bauen. Kernzug — der Host speichert nichts, der Browser des Besuchers speichert alles — sodass Pro-Besucher-Accounts, Zugriffsprüfungen und Löschfristen…
netlify-deploy
Deploy web projects to Netlify using the Netlify CLI (npx netlify). Use when the user asks to deploy, host, publish, or link a site/repo on Netlify, including preview and production deploys.
ecspresso
ECS deployment tool - deploy, manage, and troubleshoot ECS services.
securing-helm-chart-deployments
Secure Helm chart deployments by validating chart integrity, scanning templates for misconfigurations, and enforcing security contexts in Kubernetes releases.
pinme-r2
Use when a PinMe Cloudflare Worker needs R2 object storage, including secure file or image upload, streaming download, metadata lookup, deletion, listing, Range requests, or R2+D1 coordination. Guides AI to use PinMe's automatically injected env.R2 binding without R2 credentials or manual Wrangler configuration.