{"id":6457,"library":"skylos","title":"Skylos AI Code Security & Static Analysis","description":"Skylos is an open-source static analysis tool for Python, TypeScript, and Go, designed to enhance code security and quality. It identifies dead code, hardcoded secrets, exploitable vulnerabilities, and diff-aware regressions, particularly those introduced by AI-assisted coding. Skylos operates primarily as a CLI tool with a rapid release cadence, offering integrations for GitHub Actions and a VS Code extension for in-editor findings.","status":"active","version":"4.3.2","language":"python","source_language":"en","source_url":"https://github.com/duriantaco/skylos","tags":["static analysis","security","AI","code quality","linter","vulnerability","dead code","SAST","devsecops"],"install":[{"cmd":"pip install skylos","lang":"bash","label":"Install Skylos"}],"dependencies":[{"reason":"Skylos is a Python-based CLI tool and library.","package":"python","optional":false,"min_version":"3.10"},{"reason":"An indirect dependency often updated, relevant for security-related features.","package":"cryptography","optional":true}],"imports":[],"quickstart":{"code":"pip install skylos\n# Navigate to your project directory\n# cd my_python_project\nskylos . -a\n\n# To initialize a pyproject.toml for custom configuration:\n# skylos init\n# Then you can run:\n# skylos . -a --tui # for an interactive dashboard\n# skylos . --diff # to scan only changed files (auto-detects git base ref)","lang":"bash","description":"Install Skylos and run a comprehensive scan of your current project directory. The `-a` flag enables all core checks: danger, secrets, quality, and SCA (Software Composition Analysis). For custom configuration, initialize a `pyproject.toml` file."},"warnings":[{"fix":"For comprehensive dead-code verification, ensure you use `skylos agent scan <path> --verify-dead-code`.","message":"The `skylos agent scan` command changed its default behavior in `v4.2.1`. It now defaults to a 'fast review' path, and full, slow dead-code verification requires the explicit `--verify-dead-code` flag.","severity":"gotcha","affected_versions":">=4.2.1"},{"fix":"Review your `.gitignore` to ensure desired files are included/excluded. Re-evaluate dead code findings for framework-heavy projects as precision has improved.","message":"Starting with `v4.1.4`, Skylos now honors project `.gitignore` files during file discovery and intelligently treats common imperative framework entrypoints (e.g., Flask `add_url_rule`, FastAPI `add_api_route`) as live code. This significantly reduces false positives for dead code but means previously ignored files might no longer be scanned, and some 'dead' framework routes might now be correctly recognized as live.","severity":"gotcha","affected_versions":">=4.1.4"},{"fix":"Set `OPENAI_API_KEY` or `ANTHROPIC_API_KEY` environment variables or provide the key when prompted to use AI-powered features.","message":"While Skylos offers advanced AI features like `Auto-Fix (--fix)` and `Audit (--audit)`, these require an API key for a supported LLM provider (e.g., OpenAI, Anthropic). Skylos checks environment variables (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`), system keyring, or will prompt interactively.","severity":"gotcha","affected_versions":">=4.0.0"},{"fix":"Be aware of the precedence: CLI arguments take priority over `pyproject.toml` `addopts`. Configure defaults in `pyproject.toml` but use CLI flags for one-off overrides.","message":"Version `4.0.0` introduced the `addopts` configuration in `pyproject.toml` under `[tool.skylos]` to set default CLI flags (e.g., `addopts = [\"--quality\", \"--danger\"]`). However, explicit CLI flags will always override `addopts` settings.","severity":"gotcha","affected_versions":">=4.0.0"},{"fix":"Run `skylos init` in your project's root directory to generate the necessary `pyproject.toml` for configuration.","message":"To configure Skylos with custom settings (e.g., `complexity`, `nesting`, `max_args` thresholds) or to manage baselines, you must initialize your project with `skylos init`. This command creates or appends to a `pyproject.toml` file in your project root.","severity":"gotcha","affected_versions":"All versions"}],"env_vars":null,"search_vec":"'action':65 'ai':2,46,79 'ai-assist':45 'analysi':6,14,77 'assist':47 'awar':39 'cadenc':60 'cli':54 'code':3,24,31,48,69,80,85 'dead':30,84 'design':21 'devsecop':87 'diff':38 'diff-awar':37 'editor':74 'enhanc':23 'exploit':34 'extens':70 'find':75 'github':64 'go':20 'hardcod':32 'identifi':29 'in-editor':72 'integr':62 'introduc':43 'linter':82 'offer':61 'open':11 'open-sourc':10 'oper':50 'particular':41 'primarili':51 'python':17 'qualiti':27,81 'rapid':58 'regress':40 'releas':59 'sast':86 'secret':33 'secur':4,25,78 'skylo':1,7,49 'sourc':12 'static':5,13,76 'tool':15,55 'typescript':18 'vs':68 'vulner':35,83","created_at":"2026-04-15T05:38:08.872026+00:00","updated_at":"2026-04-16T21:48:51.903932+00:00","problems":[{"fix":"Ensure `pip install skylos` completed successfully. If using a virtual environment, activate it. Otherwise, locate the `skylos` executable (e.g., in `~/.local/bin` or `C:\\PythonXY\\Scripts`) and add its directory to your system's PATH.","cause":"The `skylos` executable is not in the system's PATH, the installation failed, or it was installed in a virtual environment that is not activated.","error":"skylos: command not found"},{"fix":"Navigate to the root directory of your Git repository before running `skylos`, or clone a Git repository if you haven't already.","cause":"Skylos was executed in a directory that is not part of a Git repository, preventing its features requiring Git history or context (like diff-aware regressions) from operating.","error":"fatal: not a git repository (or any of the parent directories): .git"},{"fix":"Use `skylos help` to see the list of available commands, or refer to the Skylos documentation for the correct command usage, typically `skylos analyze`.","cause":"The subcommand provided to `skylos` (e.g., `scan`) does not exist or is misspelled; `analyze` is the primary command for static analysis.","error":"Error: unknown command \"scan\" for \"skylos\""},{"fix":"Ensure the user running Skylos has appropriate read/write permissions for the target files and directories. If it's about the binary, make sure it's executable (e.g., `chmod +x /usr/local/bin/skylos`).","cause":"Skylos attempted to access a file or directory without the necessary read or write permissions, or the Skylos binary itself could not be executed due to insufficient permissions.","error":"Permission denied"}],"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":"skylos","cli_version":"","type":"library","homepage":"https://skylos.dev","github":"https://github.com/duriantaco/skylos","docs":"https://docs.skylos.dev","changelog":"https://github.com/duriantaco/skylos/blob/main/CHANGELOG.md","pypi":"https://pypi.org/project/skylos/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["testing"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-04-15","next_check":"2026-07-14","install_tag":null}}