Skills python-appservice-deploy
๐Ÿ“ฆ

python-appservice-deploy

v1.0.1 Content revision r2 High Risk โš™๏ธ External commands๐Ÿ“ Filesystem access๐ŸŒ Network access

Deploy Python Apps to Azure App Service

Deploying Python applications to Azure App Service requires coordinated resource, runtime, packaging, and startup settings. This skill guides Azure CLI or azd deployment for Linux web apps.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "python-appservice-deploy" from https://skillstore.io/skills/microsoft-python-appservice-deploy.md and its manifest at https://skillstore.io/api/skills/microsoft-python-appservice-deploy/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "python-appservice-deploy". Deploy my Flask project with the standard Azure defaults.

Expected outcome:

The skill reports the detected Flask framework, selected Azure context, created or reused resources, deployment acceptance, endpoint, and expected warm-up period.

Using "python-appservice-deploy". Deploy this FastAPI project whose application object is in src.api.

Expected outcome:

The skill reports FastAPI detection, configures src.api as the startup entry point, deploys the archive, and provides the App Service endpoint.

Using "python-appservice-deploy". Deploy my existing App Service project through azd.

Expected outcome:

The skill confirms the App Service host in azure.yaml, reuses the azd environment, deploys the service, and reports the configured endpoint.

Security Audit

High Risk
v4 โ€ข 7/23/2026 Open versioned report

Most static alerts are false positives caused by Markdown backticks, PowerShell fences, bind addresses, HTTPS endpoint templates, and benign device redirection. The retry wrappers execute caller-supplied command strings through eval or nested PowerShell, creating command-injection risk, and the PowerShell archive path can include environment secrets. No prompt injection or malicious exfiltration intent was found.

13
Files scanned
985
Lines analyzed
3
Review items
0
False positives ignored

Confirmed security concerns (1)

High
PowerShell archive can include environment secrets
The PowerShell packaging path compresses all root items except five directories and does not exclude .env. A local secret file can be uploaded in app.zip.
The exclusion list and archive operation are explicit on these lines, and .env is absent. This directly differs from the Bash path, which excludes .env.
Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Ruby/shell backtick execution
$script = "$ShowCommand -o none 2>`$null; if (`$LASTEXITCODE -ne 0) { $CreateCommand -o none }"
The script concatenates caller-provided ShowCommand and CreateCommand strings into executable PowerShell text. Shell metacharacters in either argument can alter the command and execute arbitrary code.
High
PowerShell invocation
& powershell -NoProfile -Command $script 2>&1
This line passes the dynamically constructed script to powershell -Command. Because the script contains caller-provided command strings, this is a direct command-injection sink.
High
Shell command substitution
if err=$({ eval "$SHOW_CMD -o none 2>/dev/null" || eval "$CREATE_CMD -o none"; } 2>&1); then
The wrapper applies eval to both command strings supplied by its caller. Any shell syntax embedded in those strings executes with the wrapper's privileges.

Risk Factors

โš™๏ธ External commands (50)
references/create-app.md:38 references/create-app.md:5 references/create-app.md:24 references/create-app.md:40 references/create-app.md:74 references/create-app.md:87 references/create-app.md:96 references/create-app.md:102 references/deploy-azcli.md:22-24 references/deploy-azcli.md:76-77 references/deploy-azcli.md:78-80 references/deploy-azcli.md:95 references/deploy-azcli.md:20 references/deploy-azcli.md:38 references/deploy-azcli.md:58 references/deploy-azcli.md:59 references/deploy-azcli.md:74 references/deploy-azcli.md:98 references/deploy-azd.md:16-18 references/deploy-azd.md:20-22 references/deploy-azd.md:19 references/deploy-azd.md:31 references/deploy-azd.md:72 references/deploy-azd.md:73 references/errors.md:7-8 references/errors.md:8-9 references/errors.md:9-10 references/errors.md:10 references/errors.md:41 references/post-deploy-message.md:71 references/startup-commands.md:26 references/startup-commands.md:47 references/startup-commands.md:58 references/startup-commands.md:71 references/transient-retry.md:40-42 references/transient-retry.md:37 references/transient-retry.md:38 scripts/generate-app-name.ps1:5 scripts/generate-app-name.sh:4 scripts/generate-app-name.sh:23 scripts/generate-app-name.sh:26-28 scripts/generate-app-name.sh:37 scripts/generate-app-name.sh:40 scripts/generate-app-name.sh:46 scripts/generate-app-name.sh:58 scripts/retry-az-create.ps1:3 scripts/retry-az-create.ps1:13 scripts/retry-az-create.ps1:15 scripts/retry-az-create.ps1:17-18 scripts/retry-az-create.ps1:21-22
๐Ÿ“ Filesystem access (13)
๐ŸŒ Network access (19)
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/microsoft-python-appservice-deploy/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/microsoft-python-appservice-deploy/security.svg)](https://skillstore.io/skills/microsoft-python-appservice-deploy?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/microsoft-python-appservice-deploy?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/microsoft-python-appservice-deploy/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/microsoft-python-appservice-deploy.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

microsoft. (2026). python-appservice-deploy security audit report (audit version 4) [Author version 1.0.1]. Skillstore. https://skillstore.io/skills/microsoft-python-appservice-deploy/audits/4

BibTeX citation

@techreport{microsoft-microsoft-python-appservice-deploy-2026, author = {microsoft}, title = {python-appservice-deploy security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/microsoft-python-appservice-deploy/audits/4}, note = {Author version 1.0.1} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "python-appservice-deploy security audit report (audit version 4)" version: "1.0.1" type: report authors: - name: "microsoft" date-released: "2026-07-23" url: "https://skillstore.io/skills/microsoft-python-appservice-deploy/audits/4" identifiers: - type: other value: "skillstore:microsoft-python-appservice-deploy:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
68
Architecture
100
Maintainability
87
Content
67
Community
91
Spec Compliance

What You Can Build

Deploy a first Flask service

Create the required Azure resources, package a Flask project, deploy it, and receive its App Service endpoint.

Standardize FastAPI startup

Deploy FastAPI with an explicit uvicorn entry point and consistent Linux App Service startup behavior.

Reuse an existing azd environment

Detect an App Service azure.yaml configuration and perform a subsequent code deployment through Azure Developer CLI.

Try These Prompts

Deploy a Flask project
Deploy the Flask project in this workspace to Azure App Service Linux. Show the selected subscription, region, resource group, and app name.
Deploy FastAPI with a custom entry point
Deploy this FastAPI project to Azure App Service. Detect the entry point, confirm it with me, and configure the required uvicorn startup command.
Deploy through an existing azd setup
Inspect azure.yaml and deploy through azd when its service host is App Service. Reuse the existing environment and report the endpoint.
Control production deployment settings
Deploy this Django project using my specified subscription, resource group, region, plan, and app name. Review archive contents and planned resource changes first.

Best Practices

  • Confirm the Azure subscription, resource group, region, and pricing tier before provisioning resources.
  • Inspect the deployment archive and remove secrets, local credentials, virtual environments, caches, and unrelated artifacts.
  • Treat upload acceptance separately from build and health status, then review deployment logs after the warm-up period.

Avoid

  • Do not use this skill for Windows plans, containers, Functions, databases, private networking, or full infrastructure design.
  • Do not keep secrets or local credential files inside the deployment workspace or generated archive.
  • Do not treat successful archive upload as proof that the application built, started, or passed a health check.

Frequently Asked Questions

Which Python frameworks are supported?
The workflow recognizes Flask, Django, FastAPI, generic WSGI, and generic ASGI projects. Only Flask, Django, and FastAPI receive automatic startup handling.
Does the skill create Azure resources?
Yes. The Azure CLI path can create a resource group, Linux App Service plan, and web app when they are missing.
When does it use Azure Developer CLI?
It uses azd when an existing azure.yaml service targets App Service. Otherwise, it follows the Azure CLI archive deployment path.
Does it deploy application secrets?
Secrets are not configured intentionally. Review the generated archive because local secret files can be included unless they are explicitly excluded.
Does it verify the running application?
No. It stops after deployment acceptance and reports a warm-up period, so build logs and health must be checked separately.
Can it provision databases or private networking?
No. Database, Key Vault, private networking, containers, Functions, and infrastructure-as-code requirements need a broader Azure planning workflow.

Developer Details

Author

microsoft

License

MIT

Author version

v1.0.1

Skillstore revision

r2

Ref

ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006

Maintenance freshness

7/25/2026

Usage

3 downloads ยท 0 views

File structure

๐Ÿ“ references/

๐Ÿ“„ create-app.md

๐Ÿ“„ deploy-azcli.md

๐Ÿ“„ deploy-azd.md

๐Ÿ“„ detect.md

๐Ÿ“„ errors.md

๐Ÿ“„ post-deploy-message.md

๐Ÿ“„ startup-commands.md

๐Ÿ“„ transient-retry.md

๐Ÿ“ scripts/

๐Ÿ“„ generate-app-name.ps1

๐Ÿ“„ generate-app-name.sh

๐Ÿ“„ retry-az-create.ps1

๐Ÿ“„ retry-az-create.sh

๐Ÿ“„ SKILL.md

More from microsoft

View all
View all