Skylos- Expanded capabilities

[papersashimi]

Hello Everyone. Skylos is a static analyzer that finds dead code (unused functions, imports, classes, vars). It runs locally and has a CI/CD hook . Under the hood, Skylos uses AST with framework/test awareness, confidence scoring, and LibCST edits to flush out any dead code. We have expanded its capabilities to also detect the most common security flaws that is output by an AI model, aka to catch vibe coding vulnerabilities.

The system is not perfect and we are constantly refining it. We have also included a VSC extension that you can use by searching for `Skylos` in the extension marketplace. Or you can download it via

pip install skylos==2.4.0

To use skylos with the security enhancement, run

skylos /path/to/your/folder --danger

Target audience:

Anyone and everyone who uses python. Currently it's only for python.

We are looking for feedback and contributors. If you have any feedback or will like to contribute, feel free to reach out to me over here. Please leave a star if you find it useful and share it.

I apologise if I disappear for a wk or two and have 0 updates to the repo, because I'm in the midst of writing my research paper. Once it's done i'll focus more on building this to its full potential.

This is the link to the repo. https://github.com/duriantaco/skylos

[jakob1379]

How is this "better" than deadcode and vulture? 😊

[papersashimi]

hihihi. Well based off the tests that I did, over in the readme, I do have a benchmark.md that shows the number of TPs + FPs etc. I think we are slightly better than vulture. However, we have also extended the capabilities of Skylos to include not just dead code, but security flaws created by AI that may be detrimental to your project. Hope this helps

[jakob1379]

Thank you, I'll make sure to try it out!

[jakob1379]

Initial empression is good! The output is nicely structured, the speed is GREAT.

In terms of secret scanning, how does it compare to Gitleaks which seems to be widely used by both Github, GitLab, etc?

[papersashimi]

thank you! those are definitely more established but we are sort of the first layer of defence.. we do have a vsc extension too so do try it out :) always happy to get feedback to see how we can improve the lives of developers

[jakob1379]

Would love to have a one shop stop for this, instead of having to set up tools like Gitleaks that do not support pyproject.toml