duriantaco/skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

What it solves

Skylos is a local-first static analysis tool designed to catch a wide range of code issues before they are merged. It specifically targets dead code, security vulnerabilities, leaked secrets, and quality regressions. Crucially, it addresses the "AI-code problem" by detecting common hallucinations in AI-generated code, such as invented package APIs, fake helper functions, and impossible dependency versions, as well as verifying the guardrails of LLM-powered agents.

How it works

Skylos operates as a CLI that performs static analysis across multiple languages (including Python, TypeScript, JavaScript, Java, Go, Kotlin, PHP, Rust, Dart, C#, and Shell). It uses a combination of deterministic local checks and optional LLM-powered reviews. It can be integrated into CI/CD pipelines as a PR gate or used as an MCP server to allow coding agents (like Claude or Cursor) to self-verify their changes. It also provides a framework for "AI hallucination contracts" to define repo-specific truths for generated code.

Who it’s for

It is built for developers and security teams who want a single command to audit their codebase for both traditional software defects and the specific risks introduced by AI-generated code and LLM agents.

Highlights

  • AI-Specific Detection: Identifies phantom security calls, missing guards, and hallucinated APIs in AI-generated code.
  • Agent Verification: Inventories LLM integrations and scores guardrails against OWASP LLM/Agentic Top 10 frameworks.
  • Agent Behavior Testing: Tests live OpenAI-compatible endpoints against deterministic response and tool-use contracts.
  • Multi-Language Support: Broad static analysis coverage for a wide array of popular programming languages.
  • Local-First: Core analysis runs locally without requiring cloud uploads or LLM calls by default.
  • CI/CD Integration: Provides GitHub Actions workflows to block deployments with critical security or AI-defect gaps.