Hysen Labsskylos
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/
A local first scanner for dead code and AI code mistakes
Skylos is an open source static analysis CLI that checks Python, TypeScript, and many other languages for dead code, security issues, secrets, and AI generated code errors before merge.
What it checks
Skylos is described as an open source, local first checker for pull requests and repositories. The default scan focuses on dead code such as unused functions, classes, imports, files, and framework entrypoint mistakes. Adding the -a flag turns on security, secrets, quality, dependency, and AI defect checks. The security coverage includes SQL injection, cross site scripting, server side request forgery, path traversal, command injection, and unsafe deserialization. It also flags secrets and dependency CVEs, CI/CD misconfigurations, quality regressions like deep nesting, and common AI code mistakes such as phantom helpers, invented package APIs, and impossible dependency versions.
Commands and workflows
The quickest path is two commands: pip install skylos followed by skylos . for a dead code scan. The --ai-defects flag runs only evidence backed AI defect checks, while skylos verify checks a changed file or line range before an agent hands code to review and returns pass, fail, or incomplete. A skylos contract init command creates a local AI hallucination contract that verify discovers automatically. Teams can generate a GitHub Actions pull request gate with skylos cicd init, and skylos rules init scaffolds a local YAML rule pack for project specific checks.
Agent and deployment verification
Beyond static analysis, Skylos targets AI agent safety. The discover command maps every LLM call, agent tool, prompt site, and input source in a codebase, while defend scores guardrails across 13 weighted checks and maps results to the OWASP LLM Top 10 and the Agentic ASI Top 10. It emits an attested evidence report with a reproducible SHA-256 digest and can output SARIF for GitHub code scanning. A verify_change MCP tool lets coding agents such as Claude and Cursor verify an edited file with the same schema as the skylos verify command.
Editorial conclusion
Skylos is written in Python, published under the Apache 2.0 license, and offers optional extras such as skylos[llm] for agent workflows and skylos[lint] for Ruff based linting.
Community notes