The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use shell commands, specifically curl, to perform end-to-end testing of the deployed application. This includes sending POST requests with file attachments and GET requests to verify HTTP 200 responses.
[DYNAMIC_EXECUTION]: The agent dynamically constructs and uploads a Python WSGI configuration file (flask_app.py). This script is generated at runtime to configure the application's environment path and entry point on the remote server.
[REMOTE_CODE_EXECUTION]: The documentation includes a command pattern for downloading and executing remote shell scripts (curl -fsSL <install-url> | bash). Although this is presented as a manual 'User step' that the agent is explicitly told it cannot perform, the presence of the pattern is noted as a risk factor for users who might copy-paste untrusted URLs.
[INDIRECT_PROMPT_INJECTION]: The skill defines a diagnostic workflow where the agent reads external error logs from the server (/var/log/<user>.pythonanywhere.com.error.log) to troubleshoot deployment issues. This ingestion of untrusted data from a remote file system represents a potential attack surface, as the skill does not specify sanitization or boundary markers for the log content.

deploy-pythonanywhere