duriantaco/skylos

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantaco.github.io/skylos/repo-map/

What it solves

Skylos is a local-first static analysis tool designed to catch errors, security vulnerabilities, and AI-generated code mistakes before they are merged into a codebase. It addresses the need for a unified CLI to detect dead code, secrets, dependency CVEs, and common LLM hallucinations (such as invented APIs or missing guards) across multiple languages including Python, TypeScript, JavaScript, Java, Go, Kotlin, PHP, Rust, Dart, C#, and Shell.

How it works

Skylos operates as a static analysis CLI that runs locally by default. It analyzes code without executing it, using framework-aware detection for dead code and security flaws. It provides specialized workflows for AI-assisted development, including skylos verify to check for hallucinations in specific code ranges and skylos defend to inventory LLM integrations and verify their guardrails against standards like OWASP. It also supports "AI hallucination contracts" to define repo-specific truth for generated code.

Who it’s for

It is built for developers and security teams who want to integrate automated code quality and security gates into their local workflow or CI/CD pipelines (e.g., GitHub Actions). It is particularly useful for teams shipping AI agents and LLM-powered applications that need deterministic verification of agent behavior and guardrails.

Highlights

  • AI-Specific Checks: Detects phantom security calls, fake package APIs, and impossible dependency versions common in AI-generated code.
  • Agent Verification: Inventories LLM integrations and scores guardrails (e.g., prompt injection exposure, output validation) without requiring a model in the loop.
  • Multi-Language Support: Broad coverage across major languages and deployment configurations (Kubernetes, Docker Compose).
  • MCP Integration: Provides MCP tools (verify_change, verify_agent) allowing coding agents like Claude or Cursor to self-correct code before human review.
  • Dead Code Detection: Framework-aware analysis for FastAPI, Django, Flask, and others to find unused functions and classes.
  • Agent Behavior Testing: Deterministically tests running agents against contracts to verify tool selection and response accuracy.

Related

  • Project
    LoRexxar/Kunlun-M

    An open-source static code security analysis system that uses AST graphs and taint analysis to detect vulnerabilities across 14 different programming languages.

  • Project
    DY-2026/GameDesignOS

    A local-first operating layer for AI-assisted game design that transforms fragmented AI output into structured, evidence-linked design decisions and project memory.

  • Project
    arm/metis

    An agentic AI security framework for deep security code review that uses LLMs to detect subtle vulnerabilities and reduce false positives through integrated triage.

  • Dispatch
    Combating AI Slop: A Deterministic Approach to AI-Generated Code Smells

    Explore aislop, a CLI tool designed to detect and fix common antipatterns left by AI coding agents without relying on LLMs for the analysis.

  • Project
    cisco-ai-defense/skill-scanner

    A security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code using static analysis, behavioral dataflow, and LLM-based semantic analysis.