Language Support
Skylos scans mixed-language repositories in one pass. Source files are discovered by extension, parsed with the language-specific frontend, and normalized into the same finding model used by the CLI, CI gate, JSON output, SARIF output, MCP server, and Cloud upload.
Support Matrix
| Language | Extensions | Dead Code | Security | Quality | Notes |
|---|---|---|---|---|---|
| Python | .py | Yes | Yes | Yes | Strongest coverage, framework-aware analysis, optional runtime tracing, and AI repair |
| TypeScript / JavaScript | .ts, .tsx, .mts, .cts, .js, .jsx, .mjs, .cjs | Yes | Yes | Yes | Tree-sitter parsing, package graph reachability, React and Next.js awareness |
| Java | .java | Yes | Yes | Yes | Tree-sitter parsing, Java data-flow security checks, and method quality metrics |
| Go | .go | Yes | Selected | Selected | Module-aware Go engine plus function quality metrics |
| Kotlin | .kt, .kts | Yes | Secrets | No | Thin scanner for Kotlin symbols, imports, annotations, and secret scanning |
| PHP | .php | Yes | Selected | No | PHP parser coverage with selected taint-style file and deserialization checks |
| Rust | .rs | Yes | Selected | No | Rust parser coverage with selected command and filesystem checks |
| Dart | .dart | Yes | Selected | No | Dart parser coverage with Flutter/test entrypoint handling and selected sink checks |
| C# | .cs | Yes | Selected | No | C# symbol coverage plus selected ASP.NET, process, SQL, HTTP, redirect, and file sinks |
| Shell | .sh, .bash, .zsh, .ksh, .bats | No | Selected | No | Static shell checks for command injection, SSRF, and path traversal |
Config And Deployment Support
Skylos also scans security-relevant configuration and deployment files when security analysis is enabled. These checks are reported with the same finding model as source-code rules.
| Surface | Files | Security Scope |
|---|---|---|
| GitHub Actions | .github/workflows/*.yml, .github/workflows/*.yaml, action.yml, action.yaml | dangerous triggers, token permissions, unpinned actions, template injection, secrets, OIDC, cache, and artifact policy |
| GitLab CI | .gitlab-ci.yml | mutable images, unpinned includes, literal secrets, untrusted eval, Docker-in-Docker, OIDC, cache, timeout, and runner-tag policy |
| Dockerfile | Dockerfile, Dockerfile.*, *.dockerfile | dangerous RUN commands, remote ADD without checksum, and literal build ARG / ENV secrets |
| Edge Docker Compose | compose*.yml, compose*.yaml, docker-compose*.yml, docker-compose*.yaml | privileged containers, host device/control mounts, GPU/device runtime, and host networking |
| Edge systemd | *.service | root edge services, mutable ExecStart paths, missing sandboxing, broad capabilities, and broad device access |
Selected means the scanner covers high-signal rules for that ecosystem, but
the coverage is narrower than Python, TypeScript/JavaScript, and Java.
Secrets means Skylos scans source files for hardcoded credentials through the
shared secrets engine, but does not yet provide dedicated language-specific
security sink rules for that ecosystem.
Coverage By Language
| Language | What Skylos does today |
|---|---|
| Python | Deep dead-code analysis with framework awareness, runtime trace support, security rules, secrets, quality, technical debt, repository policy, and AI repair workflows |
| TypeScript / JavaScript | Dead-code and package graph analysis, React/Next.js awareness, client-side secret exposure, browser/server security sinks, quality rules, and monorepo inventory |
| Java | Parser-backed dead-code detection, dangerous-call security checks, taint-style sink checks, weak crypto detection, and method quality metrics |
| Go | Module-aware scanning, Go-specific security rules, unified cross-language security IDs, and selected function quality checks |
| Kotlin | Thin dead-code coverage for Kotlin functions, methods, classes, objects, interfaces, imports, annotation refs, .kt / .kts files, and shared secret scanning |
| PHP | Dead-code detection for PHP symbols plus selected filesystem/include and unsafe deserialization checks |
| Rust | Dead-code coverage for Rust symbols plus selected command execution and filesystem path security checks |
| Dart | Dead-code coverage for Dart and Flutter-style projects plus selected process, HTTP, and filesystem checks |
| C# | Dead-code coverage for C# classes and methods plus selected process, SQL, HTTP, redirect, and filesystem security checks |
| Shell | Static security checks for CI/deploy/release scripts, focused on command injection, SSRF, and path traversal |
How Scans Run
# Dead code across all supported source files
skylos .
# Security and quality rules where supported
skylos . --danger --quality
# Full local audit
skylos . -a
Skylos does not require separate commands for each language. A repository with a Python API, a TypeScript frontend, a Go service, a Kotlin Android client, a Dart mobile client, a C# service, and Shell deployment scripts can be scanned from the repository root.
Shared Behavior
Across supported languages, Skylos tries to preserve the same workflow:
- detect definitions and references for dead code analysis
- report security findings with unified
SKY-Drule IDs when rules describe the same weakness - honor global exclusions, confidence thresholds, inline ignores, and rule suppressions
- include language counts and findings in JSON, SARIF, Cloud, and MCP output