Deploying Python applications to Azure App Service requires coordinated resource, runtime, packaging, and startup settings. This skill guides Azure CLI or azd deployment for Linux web apps.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "python-appservice-deploy" from https://skillstore.io/skills/microsoft-python-appservice-deploy.md and its manifest at https://skillstore.io/api/skills/microsoft-python-appservice-deploy/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.
Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Using "python-appservice-deploy". Deploy my Flask project with the standard Azure defaults.
Expected outcome:
The skill reports the detected Flask framework, selected Azure context, created or reused resources, deployment acceptance, endpoint, and expected warm-up period.
Using "python-appservice-deploy". Deploy this FastAPI project whose application object is in src.api.
Expected outcome:
The skill reports FastAPI detection, configures src.api as the startup entry point, deploys the archive, and provides the App Service endpoint.
Using "python-appservice-deploy". Deploy my existing App Service project through azd.
Expected outcome:
The skill confirms the App Service host in azure.yaml, reuses the azd environment, deploys the service, and reports the configured endpoint.
Most static alerts are false positives caused by Markdown backticks, PowerShell fences, bind addresses, HTTPS endpoint templates, and benign device redirection. The retry wrappers execute caller-supplied command strings through eval or nested PowerShell, creating command-injection risk, and the PowerShell archive path can include environment secrets. No prompt injection or malicious exfiltration intent was found.
PowerShell archive can include environment secrets
The PowerShell packaging path compresses all root items except five directories and does not exclude .env. A local secret file can be uploaded in app.zip.
The exclusion list and archive operation are explicit on these lines, and .env is absent. This directly differs from the Bash path, which excludes .env.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The script concatenates caller-provided ShowCommand and CreateCommand strings into executable PowerShell text. Shell metacharacters in either argument can alter the command and execute arbitrary code.
This line passes the dynamically constructed script to powershell -Command. Because the script contains caller-provided command strings, this is a direct command-injection sink.
if err=$({ eval "$SHOW_CMD -o none 2>/dev/null" || eval "$CREATE_CMD -o none"; } 2>&1); then
The wrapper applies eval to both command strings supplied by its caller. Any shell syntax embedded in those strings executes with the wrapper's privileges.
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
microsoft. (2026). python-appservice-deploy security audit report (audit version 4) [Author version 1.0.1]. Skillstore. https://skillstore.io/skills/microsoft-python-appservice-deploy/audits/4
BibTeX citation
@techreport{microsoft-microsoft-python-appservice-deploy-2026,
author = {microsoft},
title = {python-appservice-deploy security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/microsoft-python-appservice-deploy/audits/4},
note = {Author version 1.0.1}
}
CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "python-appservice-deploy security audit report (audit version 4)"
version: "1.0.1"
type: report
authors:
- name: "microsoft"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/microsoft-python-appservice-deploy/audits/4"
identifiers:
- type: other
value: "skillstore:microsoft-python-appservice-deploy:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this scoreEvidence Confidence: Medium
68
Architecture
100
Maintainability
87
Content
67
Community
91
Spec Compliance
What You Can Build
Deploy a first Flask service
Create the required Azure resources, package a Flask project, deploy it, and receive its App Service endpoint.
Standardize FastAPI startup
Deploy FastAPI with an explicit uvicorn entry point and consistent Linux App Service startup behavior.
Reuse an existing azd environment
Detect an App Service azure.yaml configuration and perform a subsequent code deployment through Azure Developer CLI.
Try These Prompts
Deploy a Flask project
Deploy the Flask project in this workspace to Azure App Service Linux. Show the selected subscription, region, resource group, and app name.
Deploy FastAPI with a custom entry point
Deploy this FastAPI project to Azure App Service. Detect the entry point, confirm it with me, and configure the required uvicorn startup command.
Deploy through an existing azd setup
Inspect azure.yaml and deploy through azd when its service host is App Service. Reuse the existing environment and report the endpoint.
Control production deployment settings
Deploy this Django project using my specified subscription, resource group, region, plan, and app name. Review archive contents and planned resource changes first.
Best Practices
Confirm the Azure subscription, resource group, region, and pricing tier before provisioning resources.
Inspect the deployment archive and remove secrets, local credentials, virtual environments, caches, and unrelated artifacts.
Treat upload acceptance separately from build and health status, then review deployment logs after the warm-up period.
Avoid
Do not use this skill for Windows plans, containers, Functions, databases, private networking, or full infrastructure design.
Do not keep secrets or local credential files inside the deployment workspace or generated archive.
Do not treat successful archive upload as proof that the application built, started, or passed a health check.
Frequently Asked Questions
Which Python frameworks are supported?
The workflow recognizes Flask, Django, FastAPI, generic WSGI, and generic ASGI projects. Only Flask, Django, and FastAPI receive automatic startup handling.
Does the skill create Azure resources?
Yes. The Azure CLI path can create a resource group, Linux App Service plan, and web app when they are missing.
When does it use Azure Developer CLI?
It uses azd when an existing azure.yaml service targets App Service. Otherwise, it follows the Azure CLI archive deployment path.
Does it deploy application secrets?
Secrets are not configured intentionally. Review the generated archive because local secret files can be included unless they are explicitly excluded.
Does it verify the running application?
No. It stops after deployment acceptance and reports a warm-up period, so build logs and health must be checked separately.
Can it provision databases or private networking?
No. Database, Key Vault, private networking, containers, Functions, and infrastructure-as-code requirements need a broader Azure planning workflow.