Skylos

What duriantaco/skylos does

Skylos analyzes source repositories and project configuration for dead code, security problems, hard-coded secrets, dependency vulnerabilities, maintainability issues, and common AI-generated coding mistakes. Its default scan focuses on unused functions, classes, imports, and empty files. Expanded analysis adds checks for dangerous data flows, CI/CD and deployment misconfigurations, excessive complexity, duplicate branches, deep nesting, invented APIs, impossible dependency versions, missing guards, and unsafe LLM application behavior.

Python receives the deepest analysis. TypeScript and JavaScript, Java, PHP, Dart, Rust, Go, C#, Kotlin, C++, and Shell have varying levels of support. Findings include source locations and supporting evidence where static analysis can provide it. Results distinguish concrete defects from review findings and maintainability advice, and include risk, maintainability, dead-code, and policy-gate readouts.

How it works

Skylos runs locally by default and can also operate in CI as a pull-request gate. A basic scan uses the project path, while the -a option enables the broader analyzer set. The done workflow compares a branch with its base, runs tests, and checks for deleted or skipped tests, weakened CI steps, suppressed lint or type checks, and test-only workarounds. It writes a receipt under .skylos/receipts/.

The done map command describes changed Python and TypeScript/JavaScript functions, including code differences, changed calls, callers, and removed security checks. Other workflows cover AI-defect verification, combined repository reports, recognized LLM integrations, Python cleanup candidates, local GPU deployment preflight, and container-image vulnerability scans.

Setup and configuration

Install the CLI from PyPI with pip install skylos. Typical commands include skylos . for dead-code analysis, skylos . -a for the broader checks, and skylos done --base main for branch readiness. Pytest runs automatically in the done workflow; other test runners require a test_command entry under [tool.skylos.done].

Go dead-code and security analysis uses the native skylos-go engine. Supported PyPI wheels, the container image, and the GitHub Action include that engine for listed platforms. On other platforms, skylos doctor provides a source-build command, and SKYLOS_GO_BIN can point to a separately built binary.

Tools and capabilities

• Detect unused code and empty files.
• Scan security issues, secrets, dependency CVEs, and unsafe data flows.
• Check code quality, CI/CD settings, deployment configuration, and AI-generated defects.
• Compare branches, run tests, and identify suspicious agent changes.
• Map changed functions and callers, clean Python dead code with a dry run, and scan container images.

Limitations and notes

Language coverage is uneven, with Python receiving the broadest checks. C# support is partial, Kotlin is limited to dead-code analysis, C++ covers only unused file-local functions, and Shell is security-only. Rust dead-code findings require a lower confidence threshold, while Go analysis depends on the native engine.

Static security evidence does not establish runtime exploitability or prove that the installed environment is fully covered. For uv.lock, Git, URL, path, and private-index dependencies can remain unchecked. Review dynamic calls and public APIs before deleting reported dead code. Passing a configured gate means the repository is within policy limits, not that it has zero findings.