duriantaco/skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

What it solves

Skylos acts as a quality and security gate for software projects, specifically designed to catch errors introduced by AI coding agents (like Claude Code, Cursor, or Codex) and human developers. It identifies dead code, security vulnerabilities, hard-coded secrets, and common AI-generated mistakes—such as hallucinated package imports or missing code guards—before they are merged into your codebase.

How it works

Skylos is a CLI tool that performs static analysis on your project files. It can be run locally or integrated into CI/CD pipelines to gate pull requests. It provides specific commands to verify code quality, check for dead code, and ensure that AI agents have actually finished their tasks by running tests and comparing the branch against the main codebase. It also offers optional hooks for popular AI coding tools to provide real-time feedback during the development loop.

Who it’s for

It is built for software engineering teams that use AI coding agents and want to maintain high code standards, as well as Python maintainers looking for framework-aware static analysis tools that can detect security flaws and technical debt without requiring a cloud account.

Highlights

  • AI-Agent Guardrails: Specifically flags common AI mistakes like hallucinated package versions, missing output validation, and unsafe tool usage.
  • Pull Request Gating: Automatically prevents merging if code fails security, quality, or test-completion checks.
  • Local-First: Runs locally on your machine or in your CI environment without requiring an account or API keys.
  • Multi-Language Support: Provides deep analysis for Python, with additional support for TypeScript/JavaScript, Go, Java, Rust, and others.
  • Agent Integration: Can install hooks into tools like Cursor or Claude Code to check edits and package installs in real-time.

Related

  • Project
    scanaislop/aislop

    aislop is a deterministic CLI that scans code for AI‑generated “slop” (unused imports, narrative comments, dead code, etc.) across 10 languages, scores the repo 0‑100, can auto‑fix safe issues, and integrates with AI agents, git hooks, and CI.

  • Project
    LoRexxar/Kunlun-M

    An open-source static code security analysis system that uses AST graphs and taint analysis to detect vulnerabilities across 14 different programming languages.

  • Project
    TestSprite/testsprite-cli

    A CLI tool that provides a verification layer for AI coding agents, allowing them to test their generated code against live applications and automatically fix bugs based on failure reports.

  • Dispatch
    Building a Multi-Paxos Engine: Lessons from 100K Lines of AI-Generated Rust

    A deep dive into using AI coding agents to modernize a distributed consensus engine, exploring the use of code contracts, spec-driven development, and aggressive performance tuning.