A software development company that used an HTML script tag in its company name has been forced to change its name by the Registrar of Companies, because the name 'leads to database ...

However, PyScript acts as a wrapper, allowing you to embed Python code directly between py-script tags and have it automatically executed by Pyodide.

As noted by Classic1977, CSRF does not require a script as applying an HTML post to another site could send cookies while ignoring the same origin rule in that site.