duriantaco/skylos

Code checks that show their work.
What Is Skylos?
Skylos is an open-source (Apache-2.0) CLI and pull-request gate for Python
projects that runs without an account. skylos . finds dead code: unused
functions, classes, imports and empty files. Add -a to check security bugs,
hard-coded secrets, vulnerable dependencies, code quality and AI-code
mistakes. Findings include source locations and supporting analysis;
skylos done checks whether a branch, often a coding agent's, is ready to
merge.
It is built for:
- **Teams merging pull requests from AI coding agents** such as Claude Code,
Codex and Cursor. skylos done runs your tests and flags deleted or skipped
tests, loosened CI test steps, silenced lint or type checks, and test-only
special cases.
- **Python maintainers** who want framework-aware dead-code, security and
secrets checks. Python has the deepest coverage; other languages are listed
under Language Support.
**Proof, including the misses:** 10 Skylos-assisted dead-code cleanup PRs have
been merged into the default branch in 9 open-source
projects, including Black, NetworkX, Optuna, mitmproxy and pypdf.
Real-World Results lists the 26 cleanup and quality-fix PRs in this ledger,
including the ones that were closed, reverted or never reached the default
branch. These are accepted cleanup
PRs, not endorsements.
Website |
Docs |
Repo Map |
Quick Start |
GitHub Action |
VS Code Extension |
Real-World Results |
Benchmarks |
Roadmap |
Contributing
**English** | Deutsch | 简体中文 | Translations
Skylos runs locally by default and can also gate pull requests in CI. Use it
when you want one command to check a repo or pull request for:
- dead code and unused files
- security flaws and dangerous data flows
- secrets and dependency CVEs
- CI/CD and edge-device deployment misconfigurations
- quality regressions such as complexity, duplicate branches, and deep nesting
- common AI-generated code mistakes, including missing guards, fake helpers,
invented package APIs, and impossible dependency versions
- LLM app risks such as unsafe tool use and missing output validation
Python has the deepest coverage. TypeScript/JavaScript and Java also get
dead-code, security and quality checks; PHP and Dart get dead-code and
security checks; Rust gets security checks and experimental dead code
(hidden below the default confidence threshold; --confidence 40 lists it).
Go dead-code and security checks need the native skylos-go engine: from
4.50 the PyPI wheels for Linux, macOS and Windows (x86_64 and arm64) include
it, the container image includes it and the GitHub Action builds it. On other
platforms skylos doctor prints the command that builds it from source, and
SKYLOS_GO_BIN points Skylos at a separately built engine. C# support is
partial, Kotlin is dead code only, C++ is limited to unused file-local
functions, and Shell is security only.
Skylos also checks CI/CD and deployment config. See
Language Support.
Read The Results
Remember **Risk, Maintainability, Dead code, Gate**:
| Readout | What it tells you |
|:---|:---|
| **Risk** | Highest unresolved severity and counts. One critical finding stays critical, regardless of repository size. |
| **Maintainability** | Advice counts, affected code units, and how far measurements exceed their limits. |
| **Dead code** | Removal candidates with confidence and evidence; review dynamic calls and public APIs before deleting. |
| **Gate** | Whether findings satisfy your configured limits. Passing means within policy, not zero findings. |
Finding **Type** is separate from severity: **Defect** is a concrete correctness
pattern, **Review** needs context, and **Advice** concerns maintainability or
tooling. A Review finding can still be critical. Advice stays visible in rule
groups; --expand-advice shows every location and JSON keeps complete records.
Grouping cannot improve the assessment or bypass a gate.
Security findings show recorded source-to-sink evidence when available, with
partial static analysis labeled. Dependency coverage names unresolved versions
and the supported inputs needed to check them. Neither view claims runtime
exploitability or a complete installed environment; JSON keeps the full evidence.
For uv.lock, valid Git, URL, path and private-index dependencies are shown as
**not checked**. Skylos still queries supported public packages; the coverage
gap alone does not cause exit 2. It cannot establish a clean dependency
assessment. See uv source coverage.
New source scans replace the blended A–F grade with these readouts. Disabled
checks are **not assessed**; failed checks are **incomplete**. Maintainability