skylos

library4.3.2pypypiunverified

Skylos is an open-source static analysis tool for Python, TypeScript, and Go, designed to enhance code security and quality. It identifies dead code, hardcoded secrets, exploitable vulnerabilities, and diff-aware regressions, particularly those introduced by AI-assisted coding. Skylos operates primarily as a CLI tool with a rapid release cadence, offering integrations for GitHub Actions and a VS Code extension for in-editor findings.

testing

pip install skylos

github ↗package ↗homepage ↗docs ↗changelog ↗

INSTALL

IMPORT

SIG · SKYLOS

skylos

testingpythonv4.3.2

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Install Skylos and run a comprehensive scan of your current project directory. The `-a` flag enables all core checks: danger, secrets, quality, and SCA (Software Composition Analysis). For custom configuration, initialize a `pyproject.toml` file.

pip install skylos # Navigate to your project directory # cd my_python_project skylos . -a # To initialize a pyproject.toml for custom configuration: # skylos init # Then you can run: # skylos . -a --tui # for an interactive dashboard # skylos . --diff # to scan only changed files (auto-detects git base ref)

skylos --version

Debug

Known issues

gotchaThe `skylos agent scan` command changed its default behavior in `v4.2.1`. It now defaults to a 'fast review' path, and full, slow dead-code verification requires the explicit `--verify-dead-code` flag.

fix

For comprehensive dead-code verification, ensure you use `skylos agent scan <path> --verify-dead-code`.

affects: >=4.2.1

gotchaStarting with `v4.1.4`, Skylos now honors project `.gitignore` files during file discovery and intelligently treats common imperative framework entrypoints (e.g., Flask `add_url_rule`, FastAPI `add_api_route`) as live code. This significantly reduces false positives for dead code but means previously ignored files might no longer be scanned, and some 'dead' framework routes might now be correctly recognized as live.

fix

Review your `.gitignore` to ensure desired files are included/excluded. Re-evaluate dead code findings for framework-heavy projects as precision has improved.

affects: >=4.1.4

gotchaWhile Skylos offers advanced AI features like `Auto-Fix (--fix)` and `Audit (--audit)`, these require an API key for a supported LLM provider (e.g., OpenAI, Anthropic). Skylos checks environment variables (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`), system keyring, or will prompt interactively.

fix

Set `OPENAI_API_KEY` or `ANTHROPIC_API_KEY` environment variables or provide the key when prompted to use AI-powered features.

affects: >=4.0.0

gotchaVersion `4.0.0` introduced the `addopts` configuration in `pyproject.toml` under `[tool.skylos]` to set default CLI flags (e.g., `addopts = ["--quality", "--danger"]`). However, explicit CLI flags will always override `addopts` settings.

fix

Be aware of the precedence: CLI arguments take priority over `pyproject.toml` `addopts`. Configure defaults in `pyproject.toml` but use CLI flags for one-off overrides.

affects: >=4.0.0

gotchaTo configure Skylos with custom settings (e.g., `complexity`, `nesting`, `max_args` thresholds) or to manage baselines, you must initialize your project with `skylos init`. This command creates or appends to a `pyproject.toml` file in your project root.

fix

Run `skylos init` in your project's root directory to generate the necessary `pyproject.toml` for configuration.

affects: All versions

Errors

Common errors & fixes

skylos: command not found

The `skylos` executable is not in the system's PATH, the installation failed, or it was installed in a virtual environment that is not activated.

fix

Ensure `pip install skylos` completed successfully. If using a virtual environment, activate it. Otherwise, locate the `skylos` executable (e.g., in `~/.local/bin` or `C:\PythonXY\Scripts`) and add its directory to your system's PATH.

fatal: not a git repository (or any of the parent directories): .git

Skylos was executed in a directory that is not part of a Git repository, preventing its features requiring Git history or context (like diff-aware regressions) from operating.

fix

Navigate to the root directory of your Git repository before running `skylos`, or clone a Git repository if you haven't already.

Error: unknown command "scan" for "skylos"

The subcommand provided to `skylos` (e.g., `scan`) does not exist or is misspelled; `analyze` is the primary command for static analysis.

fix

Use `skylos help` to see the list of available commands, or refer to the Skylos documentation for the correct command usage, typically `skylos analyze`.

Permission denied

Skylos attempted to access a file or directory without the necessary read or write permissions, or the Skylos binary itself could not be executed due to insufficient permissions.

fix

Ensure the user running Skylos has appropriate read/write permissions for the target files and directories. If it's about the binary, make sure it's executable (e.g., `chmod +x /usr/local/bin/skylos`).

Upgrade

Version history

4.3.2latest on PyPI · released Apr 10, 2026

Audit

Dependencies

pythonrequiredSkylos is a Python-based CLI tool and library.

cryptographyoptionalAn indirect dependency often updated, relevant for security-related features.

Agent activity

7 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/duriantaco/skylos ↗

packagehttps://pypi.org/project/skylos/ ↗

homepagehttps://skylos.dev ↗

docshttps://docs.skylos.dev ↗

changeloghttps://github.com/duriantaco/skylos/blob/main/CHANGELOG.md ↗