What is Skylos?
Ship Cleaner, Safer Code
Skylos is an open-source static analysis tool and CI/CD PR gate. It combines dead code detection, security scanning, secrets detection, quality checks, and AI-generated code guardrails in one local-first CLI.
Use it when you want to:
- remove unused code without breaking framework entrypoints
- catch exploitable flows before they reach
main - detect hardcoded secrets and risky CI/CD or edge-device configuration
- enforce standards-backed coding practices for typing, framework routes, and repo policy
- keep pull requests focused on new issues instead of legacy noise
- review AI-assisted edits for missing controls, phantom helpers, and unfinished code
Core Workflows
| Workflow | Command | What It Does |
|---|---|---|
| Dead code scan | skylos . | finds unused functions, classes, imports, files, and entrypoints |
| Main source audit | skylos . -a | adds security, secrets, config, quality, AI-defect, and dependency checks |
| Changed-code review | skylos . -a --diff origin/main | focuses on lines touched by a PR |
| Change map for review | skylos done map --base origin/main | lists each changed Python or TypeScript/JavaScript function with old and new code, callers, removed security checks and what to read first; see Change Map |
| AI-code verification | skylos verify | scans the selected source target; separately compares supported Python working changes with Git HEAD |
| Built GPU artifact preflight | skylos preflight build/app | compares exact local artifact evidence with the declared GPU fleet; OCI is UNKNOWN in the CLI |
| Container vulnerability scan | skylos image scan IMAGE@sha256:<digest> --platform linux/amd64 | uses separately installed Trivy plus registry network access; findings gate only with --fail-on |
| Combined repo report | skylos suite | runs static, debt, defense, and provenance checks; findings are report-only |
| Dead-code cleanup | skylos clean --dry-run | previews Python import/function edits without writing files |
| CI gate | skylos cicd init | generates a GitHub Actions workflow |
| Pre-deployment agent verification | skylos defend . --format md | reports guardrails for recognized Python and TypeScript/JavaScript integrations; gating is opt-in |
| Runtime agent behavior test | skylos agent test --allow-contract-endpoint | checks responses, tool selection, refusals, and source IDs against a contract |
| Agent review | skylos agent scan . | optional LLM-assisted review and fix suggestions |
verify scans source and models supported Python working changes, preflight
statically reads a local built GPU artifact, and image scan asks Trivy to
scan a remote registry image. See the CLI
Reference for the command
chooser.
How Skylos Is Different
Framework-Aware Dead Code
Generic unused-code tools often flag route handlers, pytest fixtures, Pydantic models, serializers, package entrypoints, and plugin hooks. Skylos models common framework and language patterns so dynamic code is less likely to appear as dead.
Skylos understands patterns from ecosystems such as FastAPI, Django, Flask, pytest, SQLAlchemy, Next.js, React, package exports, and plugin loading.
Data-Flow Security Scanning
Skylos does not only look for dangerous function names. It tracks untrusted input through assignments, parameters, string construction, and framework handlers into sinks such as SQL execution, HTTP clients, filesystem paths, template rendering, subprocess execution, and deserialization.
PR-Native Enforcement
Skylos can run locally or in CI. Diff-aware scans keep new work separate from legacy findings, and GitHub annotations put results where reviewers already work. Standards-backed quality checks can start as advisory CI signals before becoming hard merge gates.
Local-First By Default
Core static analysis runs on your machine without an API key or source upload. Cloud upload, LLM-assisted review, and remediation are optional. Dependency checks can query OSV or package registries, and direct image scanning contacts a registry through Trivy.
Language Support
| Language | Dead Code | Security | Quality |
|---|---|---|---|
| Python | Yes | Yes | Yes |
| TypeScript / JavaScript | Yes | Yes | Yes |
| Java | Yes | Yes | Yes |
| Go | Yes | Selected | Selected |
| Kotlin | Yes | Secrets | No |
| PHP | Yes | Selected | No |
| Rust | Yes | Selected | No |
| Dart | Yes | Selected | No |
| C# | Yes | Selected | No |
| Shell | No | Selected | No |
| Deployment config | No | Selected | No |
For detailed scanner scope, see Language Support and Rules Reference.