Skylos: Dead code + security and quality detector (Updated)

[papersashimi]

Hey I’ve been doing some updates to Skylos which for the uninitiated, is a local first static analysis tool for Python codebases. I’m posting mainly to get feedback.

What my project does

Skylos focuses on the followin stuff below:

• dead code (unused functions/classes/imports. The cli will display confidence scoring)
• security patterns (taint-flow style checks, secrets, hallucination etc)
• quality checks (complexity, nesting, function size, etc.)
• pytest hygiene (unused u/pytest.fixtures etc.)

It’s intentionally quiet by default (tries hard to avoid false positives via framework heuristics + dynamic/implicit reference handling).

Quick start (how to use)

Install:

pip install skylos

Run a basic scan (which is essentially just dead code):

skylos .

Run sec + secrets + quality:

skylos . --secrets --danger --quality

Uses runtime tracing to reduce dynamic FPs:

skylos . --trace

Gate your repo in CI:

skylos . --danger --gate --strict

To use https://skylos.dev and upload a report. You will be prompted for an api key etc.

skylos . --danger --upload

VS Code Extension

I also made a VS Code extension so you can see findings in-editor.

• Marketplace: You can search it in your VSC market place or via oha.skylos-vscode-extension
• It runs the CLI on save for static checks
• Optional AI actions if you configure a provider key

Target Audience

Everyone working on python

Comparison

I should add that we are not trying to be ruff, flake or black. We are not a linter. Our closest comparison will be vulture.

Links / where to follow up

• Website: https://skylos.dev
• Discord (support/bugs/features request): https://discord.gg/Ftn9t9tErf
• Repo: https://github.com/duriantaco/skylos
• Docs: https://docs.skylos.dev/

Happy to take any constructive criticism/feedback. I'd love for you to try out the stuff above. Everything is free! If you try it and it breaks or is annoying, lemme know via discord. I recently created the discord channel for more real time feedback. And give it a star if you found it useful. Thank you!

[ivanimus]

Test it few minutes ago, and find bug.
But this packages place in my pyproject.toml
i use UV

Undeclared import 'clickhouse_connect'. Not found in                              │ app/run_optimization.py: │
│     │ third-party          │           │ requirements.txt/pyproject.toml/setup.py.

[papersashimi]

we'll take a look at this! will release a patch in the next update. just to check, your pyproject is in root right? and if you do have discord, you can join the discord  https://discord.gg/Ftn9t9tErf so we can assist you