skylos

Skylos

Code checks that show their work.

What Is Skylos?

Skylos is an open-source (Apache-2.0) CLI and pull-request gate for Python projects that runs without an account. skylos . finds dead code: unused functions, classes, imports and empty files. Add -a to check security bugs, hard-coded secrets, vulnerable dependencies, code quality and AI-code mistakes. Findings include source locations and supporting analysis; skylos done checks whether a branch, often a coding agent’s, is ready to merge.

It is built for:

• Teams merging pull requests from AI coding agents such as Claude Code, Codex and Cursor. skylos done runs your tests and flags deleted or skipped tests, loosened CI test steps, silenced lint or type checks, and test-only special cases.
• Python maintainers who want framework-aware dead-code, security and secrets checks. Python has the deepest coverage; other languages are listed under Language Support.

pip install skylos
skylos .                  # find dead code
skylos . -a               # add security, secrets, quality, dependency and AI-code checks
skylos done --base main   # is this branch finished? runs your tests, compares with main

Working with a coding agent? Two commands:

skylos setup   # once per repo: connects Claude Code and Codex, installs their hooks, lets Done run your tests, writes the PR check, maps the code
skylos open    # every day: diagram of your code, what changed in plain English, every check run

Your agent runs the checks itself. The tutorial walks through a real session: the agent describes the code, makes a change, gets blocked and fixes it from Skylos’s fix brief.

Proof, including the misses: 10 Skylos-assisted dead-code cleanup PRs have been merged into the default branch in 9 open-source projects, including Black, NetworkX, Optuna, mitmproxy and pypdf. Real-World Results lists the 26 cleanup and quality-fix PRs in this ledger, including the ones that were closed, reverted or never reached the default branch. These are accepted cleanup PRs, not endorsements.

Website | Docs | Repo Map | Quick Start | GitHub Action | VS Code Extension | Real-World Results | Benchmarks | Roadmap | Contributing

English | Deutsch | 简体中文 | Translations

Skylos runs locally by default and can also gate pull requests in CI. Use it when you want one command to check a repo or pull request for:

• dead code and unused files
• security flaws and dangerous data flows
• secrets and dependency CVEs
• CI/CD and edge-device deployment misconfigurations
• quality regressions such as complexity, duplicate branches, and deep nesting
• common AI-generated code mistakes, including missing guards, fake helpers, invented package APIs, and impossible dependency versions
• LLM app risks such as unsafe tool use and missing output validation

Skylos supports 13 languages: Python, TypeScript/JavaScript, Java, Go, PHP, Rust, Ruby, Dart, C#, C++, Kotlin, Swift and Shell. Python has the deepest coverage. TypeScript/JavaScript and Java also get dead-code, security and quality checks; PHP and Dart get dead-code and security checks (PHP security follows request data within a function or file into command and code execution, file inclusion, HTML output, SQL, SSRF, deserialization and file paths; Dart security covers command injection, path traversal and SSRF); Rust gets command-injection and path-traversal checks and experimental dead code (hidden below the default confidence threshold; --confidence 40 lists it). Go dead-code and security checks need the native skylos-go engine: from 4.50 the PyPI wheels for Linux, macOS and Windows (x86_64 and arm64) include it, the container image includes it and the GitHub Action builds it. On other platforms skylos doctor prints the command that builds it from source, and SKYLOS_GO_BIN points Skylos at a separately built engine. C# support is partial, Kotlin dead code covers only private declarations and imports (Kotlin security covers Spring, Ktor, servlet and Android WebView basics), C++ is limited to unused file-local functions, and Shell gets security checks only. Ruby adds bounded private-method liveness, literal Rails controller callbacks and explicit Kernel command checks. Swift adds syntax-aware private-code reachability and secret scanning. Public and internal APIs are retained; Swift security-flow and quality checks are not implemented. Skylos also checks CI/CD, deployment config and two Terraform/AWS declaration policies. See Language Support.

Read The Results

Remember Risk, Maintainability, Dead code, Gate:

Finding Type is separate from severity: Defect is a concrete correctness pattern, Review needs context, and Advice concerns maintainability or tooling. A Review finding can still be critical. Advice stays visible in rule groups; --expand-advice shows every location and JSON keeps complete records. Grouping cannot improve the assessment or bypass a gate.

Security findings show recorded source-to-sink evidence when available, with partial static analysis labeled. Dependency coverage names unresolved versions and the supported inputs needed to check them. Neither view claims runtime exploitability or a complete installed environment; JSON keeps the full evidence.

For uv.lock, Cargo.lock, composer.lock, Gemfile.lock and pubspec.lock, valid Git, URL, path and private-registry dependencies are shown as not checked. Skylos still queries supported public packages; the coverage gap alone does not cause exit 2. It cannot establish a clean dependency assessment. See uv source coverage.

New source scans replace the blended A–F grade with these readouts. Disabled checks are not assessed; failed checks are incomplete. Maintainability percentages use only the relevant units actually measured, with no guessed denominators or uncalibrated grades. The independent debt and defend scores keep their meanings. See the output guide.

Choose the Right Command

Each command answers a different question. The source scan requires PATH. Bracketed paths on verify, suite, defend, and clean default to the current directory. suite and defend require a directory; verify and clean also accept a file.

Run skylos --help for this chooser, skylos <command> --help for one command, and skylos commands for the command-family map.

The report commands have different gate and network behavior:

• image scan requires Trivy on trusted PATH and uses Trivy’s remote image source, so registry network access and any required registry credentials must already be available. Without --fail-on, a completed scan exits 0 even when it reports vulnerabilities.
• suite runs in the local process and does not upload unless --upload is set, but its dependency scan can query OSV. Findings are report-only: the command exits 0 regardless of their count. Operational and output failures are nonzero; --upload can also fail for an upload error or Cloud quality gate.
• defend reports guardrail findings by default. It becomes a gate with --fail-on, --min-score, or gate settings in an explicit policy.
• clean without --dry-run or --apply is interactive and can write after the final confirmation. Its current codemods support Python imports and functions. An apply pass still exits 0 if an individual edit prints a failure, so review the completion output.
• done exits 0 on pass, 1 when a blocking check fails or does not finish, and 2 when Skylos could not run (for example, the base is not fetched). It reads its settings from the base commit, so a change cannot loosen its own gate.

Start In 60 Seconds

pip install skylos
skylos .            # find problems; your code and findings stay on your machine
skylos cloud        # optional: track results per branch on Skylos Cloud
skylos cicd init    # add a Skylos check to every pull request

That is the whole path. When skylos . finds issues, it ends by naming the next command.

skylos cloud runs every check, shows the findings, uploads them and prints this branch’s quality gate with one link to it:

✗ Quality gate on feat/login: FAILED (was PASSED on 24 Oct 15:38 UTC, 1ba9895) · 1 critical security issue
  Open: https://skylos.dev/dashboard/projects/<project>?branch=feat%2Flogin
  Sent: findings and the Done receipt (fail) · laptop upload, unverified until CI runs the workflow
  Next: fix the issues behind the failed gate, then run skylos cloud again.

The first run opens your browser to log in and pick the project for this repo. It sends findings with file paths and code snippets of up to 7 lines (none for secrets), the branch, the commit, the git author email of each flagged line, and a map of your functions and classes (names, files, lines, sizes, which calls which). Not your repository. When the repository has a committed [tool.skylos.done] table (skylos setup writes it) and the working tree is clean, it also sends this commit’s Done receipt, running skylos done first when there is none; the Sent: line says what reached Skylos Cloud. Uploads from a laptop are unverified until CI runs the workflow. It exits 0 even when the Skylos Cloud gate fails; add --gate to exit 1 (use that in CI). You never need a key to pass the gate: fix the issues that fail it. See Skylos Cloud for the other Cloud commands.

Before 4.47.2, pip install skylos also installs a Dart parser that builds from source and needs a C compiler. From 4.47.2, Dart support is the optional skylos[dart] extra. If the install fails for lack of a compiler, use the container image.

Optional Rust acceleration can be built from source. The standard installation uses Python fallbacks. See the build guide for accelerated operations and possible differences in findings.

The default scan focuses on dead code. Run every main source analyzer, including security, secrets, quality, dependency, and AI-defect checks, with -a:

skylos . -a

Check whether a branch, often an AI agent’s, is really finished:

skylos done --base main

skylos done compares the branch with its merge base on main and runs your tests. It flags deleted or skipped tests, loosened test settings and CI test steps, silenced lint or type checks, and code that special-cases the tests, advises on code the branch left without callers (including in files it did not touch), then writes a receipt to .skylos/receipts/. When tests fail, it reruns them on the merge base and labels each failure “introduced” or “already failing”; every failure still blocks by default. It runs pytest automatically; other test runners need one test_command line in [tool.skylos.done]. See the done gate guide for every check and its limits.

Run only evidence-backed AI defect checks with:

skylos . --ai-defects

Verify a repository, file, or range before an agent hands it to review:

skylos verify . --file src/app.py --range 40:75 --project-context

For a directory such as ., the AI-defect scan covers the selected tree. The separate behavior result models supported Python working-tree changes against Git HEAD; it is not the scope selector for the AI-defect scan. Dependency hallucination checks are enabled for path targets and can query package registries; use --no-dependency-hallucinations to disable those lookups. High/critical security findings (category: "security") and hard-coded secrets (category: "secret", value redacted) in the selected file/range also fail verification; use --no-security for the AI-code-only verdict. Interactive terminals get a human report. Redirected stdout and -o produce the versioned JSON result.

skylos verify schema version 2 returns pass, fail, or incomplete. incomplete means a requested proof could not be established, such as a missing local TS/JS import, computed namespace member, unsupported language-local API check, or parser surface that Skylos could not prove; it exits 2 unless --no-fail is set. The coverage object lists detected languages, expected checks, language support, missing checks, completed/skipped checks, checked references, and deterministic skip reasons. Declared third-party dependencies and recognized Node built-ins are outside the local TS/JS API proof; their references are counted in out_of_scope_references and do not make a clean verification incomplete. Unknown bare imports still require review.

Deterministic local/workspace API verification currently covers Python, TypeScript/JavaScript, Go, and Java without executing target code. PHP, Rust, Dart, C#, Kotlin, C++, and Shell retain their existing static-analysis coverage, but their local API proof is reported as unsupported and therefore incomplete. See AI Code Verification Coverage.

Create a local AI hallucination contract for repo-specific generated-code truth. skylos verify auto-discovers .skylos/ai-contract.yml:

skylos contract init
skylos contract inspect
skylos verify .

Test a running agent against deterministic response and tool-use scenarios:

skylos agent init
skylos agent test --allow-contract-endpoint

Create a project config with thresholds, ignores, and vibe dictionary extensions:

skylos init

Create a starter local rule pack:

skylos rules init
skylos rules validate .skylos/rules/local.yml
skylos rules list --json
skylos rules list cross --json
skylos rules list --packs --json
skylos cache stats

Scans with --quality or -a apply every .yml/.yaml pack in a .skylos/rules/ folder from the scanned file up to the repository root (the nearest pack wins for a rule ID). In PR CI, as with [tool.skylos], the packs come from the base branch, so a pull request cannot drop or edit the rules its own gate runs. A pack that cannot be read is skipped with a warning naming it.

Gate pull requests with GitHub Actions. No Skylos account or token is needed:

git checkout -b add-skylos-gate
skylos cicd init --no-upload
git add .github/workflows/skylos.yml
git commit -m "Add Skylos pull request gate"
git push -u origin add-skylos-gate
gh pr create --fill

The generated workflow reviews changed lines on pull requests and adds a skylos done job when it finds your tests. With --upload (the default once this machine is logged in with skylos login), it also uploads to Skylos Cloud with GitHub OIDC: pushes to your default branch, and pull requests to it, which Cloud then lists with their check and comment. A pull request is scanned as untrusted data in a job with no credentials and uploaded by a job that never checks out its files. Uploads fail until the Skylos GitHub App is installed on the repository. Your first Skylos-gated pull request walks through it in about 8 minutes, including making the checks required.

On GitLab CI, Jenkins, Bitbucket Pipelines, Azure Pipelines or CircleCI, the same skylos cicd init sets up a pull request gate for that CI instead; see Skylos on any CI.

The gate (skylos . --gate, skylos cicd gate, and the generated workflow) fails on any critical security issue, any secret, and any critical AI-code issue, such as an import of a package that does not exist on PyPI (SKY-D222) or a call to a function that is never defined or imported (SKY-L012). Other findings fail it only above count limits. Change the limits under [tool.skylos.gate] in pyproject.toml:

[tool.skylos.gate]
max_high = 5          # high-severity security issues allowed
max_quality = 10      # quality issues allowed
max_ai_defects = 10   # AI-code issues allowed (defaults to max_quality)
# AI-code issues at these severities fail the gate whatever max_ai_defects
# allows. Add "HIGH" to block more; [] turns the rule off.
block_ai_defect_severities = ["CRITICAL"]

max_ai_defects and block_ai_defect_severities are separate checks; the gate fails if either one fails. In a pull request, skylos cicd gate --diff-base reads this policy from the base branch, so a pull request cannot turn the rule off for itself. A gate policy synced from Skylos Cloud replaces the repository’s [tool.skylos.gate] section, and the gate then checks what the Cloud gate checks: its mode (zero new issues, limits per category, per severity, or both) and its limits, which the verdict line prints. Skylos Cloud counts only new issues, so check a branch with skylos . -a --gate --diff origin/main; a full scan prints a line saying so. The .skylos/config.yaml that skylos sync pull writes applies to --diff gates while it is not committed; a copy committed only on the branch does not. A Cloud gate that is turned off leaves the built-in limits. max_critical, max_secrets and fail_on_critical = false cannot loosen the critical-issue and secret rule; a gate run prints a warning when they try, and for a rules entry that is not a rule ID.

Every gate run ends with one verdict line and the reasons behind it: Quality Gate: PASSED, Quality Gate: FAILED (exit 1), or Quality Gate: INCOMPLETE — could not decide (exit 2) when required analysis did not finish, for example a lockfile the dependency scan could not resolve. Each reason names the check that stopped, how many files or dependencies it missed, and what to change. A file that does not parse is a coverage warning under the verdict, not a reason to stop: the limits are evaluated on everything else (set require_complete = true under [tool.skylos.gate.coverage] to fail instead). --format json carries the same verdict in a top-level gate object; concise, LLM, GitHub, and GitLab output print it on stderr. See Exit Codes And Incomplete Analysis.

Need more commands? Read the CLI Reference.

Check Every Agent Edit (Claude Code, Codex, Cursor)

Install local hooks so the agent is checked while it works, not after. skylos setup installs the Claude Code and Codex hooks for a repository; the commands below install one agent at a time, or Cursor:

skylos agent install-hooks            # Claude Code (.claude/settings.json)
skylos agent install-hooks --codex    # Codex (.codex/hooks.json)
skylos agent install-hooks --cursor   # Cursor (.cursor/hooks.json)

• After each edit: verifies only the changed lines (security, secrets, AI-code mistakes) and tells the agent what to fix.
• Before a file read: blocks files that contain hard-coded secrets.
• Before a package install or one-shot run (pip, uvx, npx, pnpm dlx, bunx, go run pkg@v, …): blocks hallucinated or typosquatted packages, versions reported as malware (OSV, with the ca9 feed offline), releases younger than 48 hours (naming the older version to use instead) and npm releases that lost their provenance. npm ci, uv sync, pip install -r and other lockfile installs get the malware check over every locked package. It asks before installs it cannot verify (git and URL sources, unknown registries, failed lookups). Change the wait with [tool.skylos.supply_chain] min_release_age_hours (0 turns it off).
• MCP servers and agent hooks: the agent hook blocks unpinned or malicious MCP servers (claude mcp add, .mcp.json edits) with the exact pinned command to use, asks before new SessionStart or folderOpen hooks, and re-checks configured servers each session.
• skylos agent harden prints each agent’s own credential-deny and pinned-MCP settings (policy and audit, not a sandbox).
• Before a git command: blocks --no-verify, HUSKY=0 and other ways around the repository’s git hooks.
• At stop: blocks “done” while issues the agent added are still open.

Hooks fail open, but never silently: if Skylos errors, the agent and you are told the action was allowed without a check, and stop reports how many went unchecked. They log to .skylos/hook.log and merge with your existing hooks. --uninstall removes only the Skylos entries. See Agent-loop hooks for the contract, latency, and limits.

In Cursor, findings arrive at stop rather than after each edit. The hooks are not a sandbox: they check edits, file reads and package installs, not every command. See what they don’t do.

Common Workflows

What Skylos Catches

See the full Rules Reference.

Dependency licenses

skylos sbom . writes declared dependency licenses into CycloneDX, and skylos sbom . --format spdx-json writes an SPDX 2.3 SBOM. Licenses come from lockfiles and installed package metadata, offline. Unknown or ambiguous values (such as BSD) stay NOASSERTION rather than being guessed. --license-lookup opts in to a deps.dev query. To block licenses in -a scans, set a policy:

[tool.skylos]
license_deny = ["GPL-*", "AGPL-3.0-only"]
license_severity = "HIGH"

Violations are reported as SKY-SCA-LIC001. See License compliance.

Give Coding Agents Project Standards

Create .skylos/standards.md with the guidance you want agents to follow:

# Coding standards

- Keep functions focused and handle exceptions explicitly.
- Add a focused test when changing behavior.

Then install the project skill and choose any Skylos quality rules to enforce:

skylos agent install-standards --enforce SKY-L002
skylos agent install-hooks --codex   # use --cursor for Cursor, or omit for Claude Code
skylos agent check-standards .       # run this project-wide check in CI

The installer writes SKILL.md files for Codex, Cursor, and Claude Code. Agent skills provide guidance; the hooks and project-wide check enforce the selected built-in quality rules. See project standards for the generated files, rule selection, and coverage limits.

Verify AI Agents Before They Ship

Runtime guardrails are the WAF; Skylos is the SAST. skylos discover scans Python and TypeScript/JavaScript for recognized LLM integrations (provider SDKs, agent frameworks including the OpenAI Agents SDK, Claude Agent SDK, and Google ADK, MCP servers and their tools, direct HTTP calls to LLM APIs or OpenAI-compatible gateways, plus agent tools, prompt sites, and input sources). skylos defend checks the guardrails around those detected integrations deterministically, in the local process, with no model in the loop. It emits evidence by default and becomes a CI gate only when a threshold flag or policy supplies gate criteria.

skylos discover .                               # inventory LLM integrations and agent tools
skylos defend .                                 # score guardrails (13 weighted checks)
skylos defend . --format md -o evidence.md      # auditor evidence report + attestation
skylos defend . --format sarif -o defend.sarif  # GitHub code scanning upload
skylos defend . --fail-on critical              # CI gate: exit 1 on critical gaps
skylos defend . --owasp-framework agentic       # report against OWASP Agentic ASI Top 10

These commands do not inspect integrations in other languages. If discovery finds no supported integration, defend returns an empty inventory; do not treat the resulting score by itself as proof that an unsupported or unrecognized agent implementation has guardrails.

Per integration it verifies: dangerous output sinks (eval/exec/subprocess), agent tool scope and typed schemas, prompt-injection exposure (delimiters, untrusted input paths, RAG context isolation), output validation, PII filtering, and model pinning — plus ops checks (logging, cost controls, rate limiting) scored separately so they never inflate the security score.

• OWASP mapping: LLM Top 10 (2024/2025) and Agentic ASI Top 10 (2026).
• Evidence report (--format md): integration inventory, per-check results, OWASP coverage, regulatory framework evidence (EU AI Act, NIST AI RMF, ISO/IEC 42001 — “evidence toward” mappings, never compliance claims), and a remediation appendix.
• Attestation: JSON/md/SARIF reports carry a reproducible SHA-256 digest over file contents, policy, plugin set, integration inventory, scores, and full check evidence — re-run on the same tree with the same flags and Skylos version, and the digest must match.
• CI-native: skylos cicd init --defend generates the GitHub Actions workflow step, the skylos-defend pre-commit hook gates locally, and $GITHUB_STEP_SUMMARY gets a score summary automatically in Actions.
• Policy as code: skylos-defend.yaml pins gate thresholds and severity overrides (--policy).
• Agent-native: the verify_agent MCP tool lets coding agents verify the agents they build — deterministic verification, not AI checking AI.

Static pre-deployment verification complements runtime controls (gateways, policy engines, human approval flows); it does not replace them. Full guide: docs/agent-verification.md.

Test Running Agent Behavior

Skylos separates generated-code truth, static agent guardrails, and observed runtime behavior:

Create .skylos/agent-test.yml, then test a live OpenAI-compatible endpoint:

skylos agent init
skylos agent test --allow-contract-endpoint

Or evaluate captured evidence without a network call:

skylos agent test --observations agent-observations.json
skylos agent test --observations agent-observations.json \
  --format json --output agent-results.json

Version 1 deterministically checks exact response substrings, required, allowed, and forbidden tool calls, tool arguments and sequence, maximum call count, explicit refusals, and explicit source IDs. Missing typed evidence is incomplete, never pass; exit codes are 0 pass, 1 violation, and 2 incomplete/invalid. Tool selection and final-answer source-ID checks are separate one-turn scenarios: Skylos records local replayable evidence but never executes tools returned by the target agent. Offline observations are marked as unverified fixtures rather than runtime proof.

For an authenticated remote endpoint, keep the destination and secret choice in the trusted CLI invocation:

skylos agent test --endpoint https://agent.example.com/v1/chat/completions \
  --allow-remote --auth-env MY_AGENT_API_KEY

Full guide: docs/agent-behavior-testing.md.

How Skylos Fits

Skylos is not a replacement for every specialized scanner. It is a local-first repo and PR checker that puts several common review checks behind one CLI.

• Framework-aware dead code detection: FastAPI, Django, Flask, pytest, SQLAlchemy, Next.js (App/Pages Router files and metadata routes), React, Laravel (auto-discovered commands, listeners, components, factories, seeders), Drupal (classes named in an extension’s YAML, discovered plugins, OOP hooks, procedural hooks in .module/.install/.inc/.theme files, post-update functions), tool config files, package entrypoints, and common plugin patterns.
• PR-focused output: diff scanning, CI thresholds, GitHub annotations, and baselines for existing findings.
• Local-first operation: core analysis executes locally and does not upload source or call an LLM. Dependency/CVE checks can query OSV or package registries, and direct container scanning contacts a registry through Trivy. See What Leaves Your Machine.
• AI-assisted change review: checks for removed validation, auth, logging, CSRF, rate limiting, timeouts, real-package API hallucinations, and other guardrails in generated or edited code.
• Agent-loop verification: skylos verify and MCP verify_change use a versioned result schema for AI-code trust, security, and secret findings, so coding agents can self-correct before a human sees the change. The CLI renders a human report on a terminal and JSON when redirected or written with -o.
• Evidence-backed AI defects: --ai-defects and full scans put strict AI-code failure checks under ai_defects, including phantom references, fake package APIs, nonexistent packages, impossible dependency versions, and weakened test assertions. The category/tag is ai_defect; several rules intentionally keep historical SKY-L or SKY-D IDs for suppression and baseline compatibility, while new AI-defect-only checks use SKY-A.
• Verification-backed remediation: security fixes are checked by re-running analysis, and supported findings can include targeted regression-test proof metadata.
• Project-specific rules: add local YAML rules and extend prompt, credential, sensitive-file, and timeout dictionaries from config.
• One command surface: dead code, security, secrets, dependency, quality, technical debt, agent review, and pre-deployment agent verification commands share the same CLI.

What Leaves Your Machine

Skylos sends nothing to Skylos Cloud unless the command or flag you ran says it talks to Skylos Cloud: skylos cloud, --upload, skylos login, whoami, project, sync, credits, upload, ingest claude-security, verify-verdict, feedback, or the --verify scan option. A token on its own (SKYLOS_TOKEN, a saved skylos login, a CI OIDC token) never makes a command upload a scan, findings or a run summary. There is no update check and no analytics.

• --ai-review and --verify-security never send anything to Skylos Cloud by themselves. They send the flagged file (comments removed) and the rule’s message to your own model provider with your key. With TYPESAFE_API_KEY set, --ai-review also sends the unused-code candidates and a bounded copy of your first-party source (at most 64 KB) to Jev (api.typesafe.ai). The verdicts reach Skylos Cloud only with --upload or skylos cloud.
• skylos agent verify, agent remediate and agent remediate --standards send a run summary only with --upload, and skylos agent scan --upload sends the same summary plus its findings: one POST /api/agent-runs with command, per-command counts, model, provider, duration_seconds, commit_hash, branch, actor and status. actor is SKYLOS_ACTOR, the CI-reported user, or the HEAD commit’s author, else null; never your operating-system user name. No source, paths, finding text, prompts or model output.
• Three things reach Skylos Cloud without such a command, and none sends code or findings: a scan downloads your Cloud custom rules when a token can be found (SKYLOS_CUSTOM_RULES='[]' skips it); skylos doctor checks your credit balance (--format json skips it); and the MCP server started with SKYLOS_API_KEY checks the key every 15 minutes and asks Skylos Cloud to charge each scan or remediate call. Only remediate costs credits (10 a call), and only when it calls a model; dry runs send no charge request.
• skylos feedback makes no request itself: it opens a form on skylos.dev (or, with --github, GitHub’s issue form) in your browser. The page address carries the Skylos version, OS, Python version and the last failed command with paths and secrets masked; your message is sent only when you press Send.
• Package lookups on other hosts send package names and versions, never source: OSV for dependency checks, and PyPI, npm, the Go proxy and JSR for packages that don’t exist (on by default in skylos done, skylos verify, agent scan, agent pre-commit and the agent hooks). Dependency checks can also fetch GitHub fix commits, with GITHUB_TOKEN if it is set. LLM commands send code excerpts to the model provider you configure, and skylos cicd review posts PR comments through gh.

Every request, its trigger and its off switch: docs/privacy-and-network.md.

Agent Harness Artifacts

skylos agent verify . and skylos agent test record replayable artifacts under .skylos/runs/<run-id> and print the run directory in table output. JSON output includes the same harness summary under the harness key.

Use skylos agent replay .skylos/runs/<run-id> to validate and inspect a saved run without making LLM calls. Add --format json when another agent or CI job needs machine-readable status. A valid replay exits 0; an invalid or corrupt artifact set exits 1 with issue codes. Replay output includes schema_version so CI and agents can detect artifact-contract changes. Replay checks internal consistency and corruption; artifacts are not signed and are not proof against an actor that can rewrite the entire run directory.

Each run directory contains:

• events.jsonl: chronological run, phase, and tool-call events.
• state.json: full observable state, including phases, tool calls, decisions, and budget usage.
• summary.json: compact status, counts, budget, and artifact paths.
• behavior-results.json: normalized runtime assertions, provenance, coverage, and a digest-bound evidence report for skylos agent test runs.

The current harness state is observable and replay-validated. It is not yet a resume mechanism for continuing interrupted verification runs.

Install Options

# Core static analysis
pip install skylos

# LLM-powered agent workflows
pip install "skylos[llm]"

# Ruff Python linting through `skylos lint`
pip install "skylos[lint]"

# Ed25519 verification for `skylos verify-verdict`
pip install "skylos[verdict]"

# Dart analysis, 4.47.2 and later (builds the Dart parser from source; needs a C compiler)
pip install "skylos[dart]"

# All published optional extras
pip install "skylos[all]"

Container image:

docker pull ghcr.io/duriantaco/skylos:latest
docker run --rm -v "$PWD":/work -w /work ghcr.io/duriantaco/skylos:latest . --json --no-provenance

The unqualified image uses Python 3.14. Runtime-specific tags are also published for Python 3.11 through 3.15, so container scans can match a local or CI parser exactly:

docker run --rm -v "$PWD":/work -w /work ghcr.io/duriantaco/skylos:latest-python3.15 . --json --no-provenance

If a Python file cannot be parsed, Skylos names it as not analysed, marks coverage incomplete, and reports every other finding; the file is never treated as clean. The exit code is decided on the code that was analysed; --strict exits 2 instead, and so does a scan where most of the code could not be analysed. See Exit Codes And Incomplete Analysis.

See Installation for source installs, container usage, and optional dependencies.

Configure Vibe Checks And Entrypoints

Run skylos init to add these sections to pyproject.toml:

[tool.skylos]
exclude = ["node_modules", "dist"]

[tool.skylos.vibe]
extra_phantom_names = ["verify_enterprise_auth"]
extra_phantom_decorators = ["tenant_admin_required"]
extra_credential_names = ["tenant_signing_secret"]
extra_network_timeout_calls = ["vendor_sdk.fetch"]

[tool.skylos.dead_code]
entrypoints = []

[[tool.skylos.dead_code.entrypoints]]
type = "method"
name = ["create", "pre_hook", "post_hook"]
parent = { name = "Main", base_classes = ["Application"] }
path = "src/**"
reason = "project framework lifecycle hook"

[tool.skylos.contribution]
collect_local_signals = false
contribute_public_corpus = false
structural_signatures_only = true
include_source = false

LLM prompt templates are not read from the repository: pass a trusted file with --prompt-template KIND=PATH to skylos agent scan, agent audit, agent security-quick or agent security-deep (KIND is security, quality, security_audit or review). A template extends Skylos’ built-in prompt; it does not replace the JSON-only output contract or untrusted-code safety rules. Vibe dictionary extensions let teams teach Skylos about local fake-auth helpers, project credential names, sensitive files, and network calls that must set timeouts. Dead-code entrypoints let teams mark proprietary framework classes, lifecycle methods, and decorator-registered functions as live using precise rules for type, name, path, decorators, base classes, and parent classes. Rules must include a symbol selector such as name, decorators, base_classes, or parent; path and module only narrow the match. Contribution signals are off by default; when enabled, Skylos records local structural accept/dismiss/learn events under .skylos/contribution/ without raw source.

Where settings come from. Skylos walks up from the scan path to the repository root (the folder with .git) and reads, in each folder, the first of these that exists:

1. .skylos.toml
2. skylos.toml
3. pyproject.toml with a [tool.skylos] table (a pyproject.toml without one is skipped, so it no longer hides the settings above it)

skylos.toml takes the same keys as [tool.skylos], at the top level, so TypeScript, Go and Java repositories need no pyproject.toml:

# skylos.toml
exclude = ["generated", "dist"]

[gate]
max_security = 0

[done]
test_command = "npm test"

In a monorepo every file found on the way up applies: the repository root is the base and the file nearest the scanned folder wins per key. A key set in a package replaces the root’s value (lists are replaced, not concatenated); tables such as [gate] merge key by key. Set root = true in a package’s file to ignore everything above it. skylos doctor lists the files in use, nearest first, and the ones it ignored. In PR CI, settings come from the base commit only, with the same rules, and skylos done reports an added or edited skylos.toml as a change to Skylos settings (SKY-A114). [done] and [approval] settings are read from the repository root’s file.

To use one file instead of discovery, pass --config-file PATH or set SKYLOS_CONFIG_FILE; it may use [tool.skylos], [skylos], or (when named skylos.toml) top-level keys. Synced Skylos Cloud policy keeps its protected precedence over repository-controlled config. The top-level [tool.skylos].exclude list applies to the main scan and commands such as skylos debt and skylos clean; pass --exclude for command-local additions or --include-folder to override an excluded folder.

A full scan skips generated and vendored files (Django migrations, static/**/lib/**, *.min.js, *.min.css, vendored-library banners) and says how many in one line of output. Set include_generated = true under [tool.skylos] (or pass --include-generated) to scan them; see What a full scan leaves out.

Language Support

¹ Go dead-code and security checks need the native skylos-go engine. From 4.50 the PyPI wheels for Linux, macOS and Windows (x86_64 and arm64) include it; the container image includes it and the official GitHub Action builds it. Elsewhere, skylos doctor prints the command that builds it. Without it only Go quality checks run and the Go files are reported as not analysed; see the Go engine note below.

² Kotlin dead code reports only private types and functions and unused imports; every non-private declaration is treated as used. Any use in code counts: type positions, ::foo, trailing-lambda and infix calls, string templates and KDoc links; operator-convention imports (getValue, plus, component1) are never reported. Kotlin security is lexical (no Kotlin parser): see the Kotlin paragraph below. Secret scanning covers .kt and .kts.

³ From 4.47.2, Dart checks need the optional skylos[dart] extra (pip install "skylos[dart]"); earlier releases install the Dart parser by default. The parser has no prebuilt wheels, so installing it needs a C compiler. Without it, a scan that includes .dart files reports them as not analysed (SKY-ANALYSIS-INCOMPLETE, incomplete coverage) instead of skipping them silently; skylos doctor shows whether Dart support is installed.

⁴ Rust dead code is experimental: general trait-method calls, pub items used across crates, re-exports, macro expansion and #[bench] functions are not resolved, and a previous hand-checked sample on ripgrep found no true positives. Rust candidates are capped at confidence 40, below the default threshold, so they are not listed unless you pass --confidence 40; the scan says so in one line. rustc’s own unused_imports and dead_code lints cover private items.

Rust can prove selected local trait uses across ordinary, fully scanned source modules and keep repeated import aliases distinct. Cargo features, attributed module paths and general compiler type resolution remain outside that proof.

Rust quality checks cover statements after a direct return, break or continue, and duplicate multi-statement if/else bodies with a plain boolean condition. They do not expand macros or infer complete control flow.

Inline suppression works the same way in every language above: put skylos: ignore[SKY-D211] reason (only the named rules), skylos: ignore (every rule) or a skylos: ignore-start … skylos: ignore-end block in a comment on the finding’s line (# in Python, Shell, PHP and Ruby; // or a one-line /* */ in the others). It covers dead code, security, quality and secrets; text inside a string literal never counts, and other tools’ markers (#nosec, //nolint, NOSONAR, @SuppressWarnings) do not hide Skylos findings.

--secrets also reads shell scripts (including extensionless ones that start with a shell #! line), C and C++ sources and headers, Dockerfiles, Terraform .tf/.tfvars/.hcl, .properties, XML, Gradle, .npmrc and .pypirc.

“No” means Skylos has no built-in rules of that kind for the language.

C# dead-code findings are conservative: in a complete executable or web application scan, unreferenced public types and methods are low-confidence candidates; library APIs, protected members, and known framework or configured entry points remain externally reachable. Constructors are not reported as unused functions unless they are private, take parameters and nothing calls them (Roslyn IDE0051’s rule); controller and dependency-injection constructors are called by the framework. C# source-file reachability is not implemented. Quality scanning detects statements after unconditional return, throw, break, or continue in a direct block; it is not full control-flow analysis. Security (--danger) treats ASP.NET request data as input: controller action, Razor Page handler, minimal API and [From*] parameters and Request.*, not constructor or plain service parameters, and follows it into same-file helper methods. It reports SQL injection (ADO.NET, EF raw SQL, Dapper), command injection, path traversal, SSRF (HttpClient, WebClient, WebRequest, RestSharp), open redirect (not LocalRedirect or a Url.IsLocalUrl guard), unsafe deserialization (BinaryFormatter family, Json.NET TypeNameHandling, SimpleTypeResolver) and XSS through HtmlString/Html.Raw/MarkupString and HTML responses, each with a CWE. Methods that share a sink’s name (a repository’s GetAsync) count only on the right receiver type. Generic secret scanning covers .cs files when --secrets or -a is enabled. .cshtml/.razor markup, flow across files and interpolated raw-string expressions are not yet followed by C# taint analysis. SCA inventories direct NuGet PackageReference entries in .csproj files. Only unconditional exact Version pins ([version]) without local Update/Remove mutations, not VersionOverride or centrally managed versions, can be checked a

README 内容过长，已截取前 64 KB。完整内容请前往 GitHub 仓库查看。