Skylos

https://docs.skylos.dev/
Admin
Skylos is an AI-powered platform for static code analysis, identifying defects, security...
Tokens:88,610
Snippets:1,387
Trust Score:5.7
Update:3 months ago
Show doc for...
Tokens:
Raw
### Setup Local LLM with Ollama

Source: https://docs.skylos.dev/ai-features

Install Ollama, pull a model, and configure the Skylos agent to use the local provider.

```bash
# Install Ollama  
curl -fsSL https://ollama.com/install.sh | sh  
  
# Pull a code model  
ollama pull qwen2.5-coder:7b  
  
# Use with Skylos  
skylos agent scan ./src \
  --provider openai \
  --base-url http://localhost:11434/v1 \
  --model qwen2.5-coder:7b  
```

--------------------------------

### Install Mintlify CLI

Source: https://docs.skylos.dev/development

Global installation command for the Mintlify CLI using npm.

```bash
npm i -g mint
```

--------------------------------

### Preview Documentation Locally

Source: https://docs.skylos.dev/development

Starts a local development server for documentation previewing.

```bash
mint dev
```

--------------------------------

### Install Skylos via Package Managers

Source: https://docs.skylos.dev/installation

Standard installation commands for Python environments using pip or uv.

```bash
pip install skylos
```

```bash
uv pip install skylos
```

--------------------------------

### Install Skylos

Source: https://docs.skylos.dev/faq

Use pip to install the Skylos package.

```bash
pip install skylos  
```

--------------------------------

### Set up AI features

Source: https://docs.skylos.dev/faq

Install the LLM extra, configure the API key, and run the agent scan.

```bash
pip install "skylos[llm]"  
export OPENAI_API_KEY="sk-..."  
skylos agent scan .  
```

--------------------------------

### Configure Confidence Thresholds

Source: https://docs.skylos.dev/framework-awareness

Command-line examples for setting the confidence threshold to filter findings.

```bash
skylos . -c 60  # Default: only flag >= 60% confidence  
skylos . -c 40  # Include more uncertain findings  
skylos . -c 0   # Show everything (debug mode)  
```

--------------------------------

### Install Skylos Optional Extras

Source: https://docs.skylos.dev/installation

Commands to install specific feature sets or all available extras.

```bash
pip install "skylos[llm]"
```

```bash
pip install "skylos[all]"
```

--------------------------------

### Default Configuration Settings

Source: https://docs.skylos.dev/

Example of the default settings added to pyproject.toml.

```toml
[tool.skylos]  
complexity = 10  
nesting = 3  
max_args = 5  
```

--------------------------------

### Configure Skylos Settings

Source: https://docs.skylos.dev/vscode

Example configuration for the settings.json file to enable AI-powered fixes.

```json
{
  "skylos.openaiApiKey": "sk-...",
  "skylos.aiProvider": "openai"
}  
```

--------------------------------

### Dynamic usage example

Source: https://docs.skylos.dev/guides/penalty-system

Example of code that appears unused but is invoked dynamically, triggering a confidence penalty.

```python
# Looks unused, but called dynamically  
def handle_user_created(event):  
  notify_admins(event)  
  
# Called via: getattr(handlers, f"handle_{event_type}")
```

--------------------------------

### Install Skylos VS Code Extension

Source: https://docs.skylos.dev/vscode

Command to install the extension directly from the VS Code command line.

```bash
ext install oha.skylos-vscode-extension  
```

--------------------------------

### Diff-Aware Rule Examples

Source: https://docs.skylos.dev/ai-defects

Examples of diff-based changes that trigger AI-defect analysis.

```diff
-assert result.status == "paid"  
+assert result is not None  
```

```diff
+permissions: write-all  
```

```diff
-parser.add_argument("--quality", action="store_true")  
```

--------------------------------

### Configure Pre-commit Hook

Source: https://docs.skylos.dev/concepts/vibe-coding

Example of a pre-commit hook to catch issues before code is committed.

```bash
# Pre-commit hook  
skylos . --danger --quality --ai-defects || exit 1  
```

--------------------------------

### JSON output structure

Source: https://docs.skylos.dev/technical-debt

Example of the JSON schema returned by the debt command.

```json
{
  "score": {
    "score_pct": 68,
    "scope": "project"
  },
  "summary": {
    "scope": {
      "score": "project",
      "hotspots": "changed"
    }
  },
  "hotspots": [
    {
      "file": "app/services.py",
      "score": 27.87,
      "priority_score": 38.87,
      "baseline_status": "worsened"
    }
  ]
}
```

--------------------------------

### Configure CI Gate

Source: https://docs.skylos.dev/concepts/vibe-coding

Example configuration for a CI pipeline to prevent AI debt accumulation.

```yaml
- run: skylos . --danger --quality --ai-defects --gate  
```

--------------------------------

### Define unittest Lifecycle Methods

Source: https://docs.skylos.dev/guides/penalty-system

Standard setup and teardown methods for unittest test cases.

```python
class TestExample(unittest.TestCase):  
    def setUp(self): ...                 # Skipped  
    def tearDown(self): ...              # Skipped  
    def setUpClass(cls): ...             # Skipped  
```

--------------------------------

### Run Web Dashboard

Source: https://docs.skylos.dev/cli-reference

Starts the local web dashboard. This command is deprecated in favor of analysis commands.

```bash
skylos run [--port <port>] [--exclude-folder <folder>] [--include-folder <folder>] [--no-default-excludes]
```

--------------------------------

### Configure Skylos in pyproject.toml

Source: https://docs.skylos.dev/installation

Example configuration block for setting analysis thresholds and gatekeeper rules.

```toml
[tool.skylos]
# Analysis Settings
complexity = 15  # Max Cyclomatic complexity (Default: 10)
nesting = 5  # Max indentation depth (Default: 3)
max_args = 5  # Max arguments per function
max_lines = 100  # Max lines per function
ignore = ["SKY-L002"] # List of Rule IDs to ignore

# Gatekeeper Settings (skylos --gate)
[tool.skylos.gate]
fail_on_critical = true
max_security = 0
max_quality = 10
strict = false  # Set true to disable interactive bypass in CI
```

--------------------------------

### Advanced agent scan configurations

Source: https://docs.skylos.dev/ai-features

Examples for using local LLM providers, applying automated fixes, and exporting results in SARIF format.

```bash
# Basic analysis  
skylos agent scan ./src  
  
# With local Ollama  
skylos agent scan ./src \  
  --provider openai \  
  --base-url http://localhost:11434/v1 \  
  --model codellama:13b  
  
# Generate and apply fixes  
skylos agent scan ./src --fix --apply  
  
# Output as SARIF for CI integration  
skylos agent scan ./src --format sarif --output results.sarif  
```

--------------------------------

### Example Python LLM Integrations

Source: https://docs.skylos.dev/ai-defense

A comparison between an insecure LLM implementation using eval() and a secure implementation using structured validation and constraints.

```python
import openai  
import logging  
  
logger = logging.getLogger(__name__)  
client = openai.OpenAI()  
  
def ask_ai(user_input):  
    """Insecure: no validation, no delimiters, eval on output."""  
    prompt = f"Help me with: {user_input}"  
    response = client.chat.completions.create(  
        model="gpt-4o",  
        messages=[{"role": "user", "content": prompt}]  
    )  
    result = response.choices[0].message.content  
    eval(result)  # dangerous!  
    return result  
  
def safe_ask(user_input):  
    """Secure: delimiters, validation, logging, max_tokens."""  
    if len(user_input) > 1000:  
        raise ValueError("Input too long")  
    prompt = f"---\nUser request:\n{user_input}\n---\nRespond in JSON."  
    logger.info("Calling LLM with prompt length %d", len(prompt))  
    response = client.chat.completions.create(  
        model="gpt-4o-2024-11-20",  
        messages=[{"role": "user", "content": prompt}],  
        max_tokens=500  
    )  
    import json  
    result = json.loads(response.choices[0].message.content)  
    return result
```

--------------------------------

### Verify JSON Output Schema

Source: https://docs.skylos.dev/cli-reference

Example of the JSON structure returned by the verify command for agent consumption.

```json
{
  "schema_version": 1,
  "tool": "verify_change",
  "status": "fail",
  "findings": [
    {
      "rule_id": "SKY-D224",
      "vibe_category": "api_signature_hallucination",
      "ai_likelihood": "high",
      "range": {
        "file": "src/app.py",
        "start_line": 42,
        "start_col": 0,
        "end_line": 42,
        "end_col": 0
      },
      "message": "Call uses an API shape that is not present in the installed package.",
      "suggested_fix": "Update the call to match the installed package API surface.",
      "confidence": 80,
      "severity": "HIGH",
      "category": "ai_defect"
    }
  ]
}
```

--------------------------------

### Static Analysis Limitation Example

Source: https://docs.skylos.dev/smart-tracing

Demonstrates a direct function call that static analysis can successfully detect.

```python
def helper():  
    return "I help"  
  
def main():  
    helper()  # Static analysis sees this call  
```

--------------------------------

### Skylos Analysis Output Example

Source: https://docs.skylos.dev/typescript-support

A sample report showing detected unreachable functions, security issues, and quality metrics.

```text
──────────────────── Unreachable Functions ────────────────────  
 #   Name                 Location  
 1   unusedHelper         src/utils.ts:45  
 2   deprecatedFunc       src/legacy.ts:12  
 3   OldInterface         src/types.ts:8  
  
───────────────────── Security Issues ─────────────────────────  
 #   Rule       Severity   Message                             Location  
 1   SKY-D501   Critical   Use of eval() detected              src/dynamic.ts:23  
 2   SKY-D502   High       Unsafe innerHTML assignment          src/render.tsx:67  
 3   SKY-D503   High       document.write() can lead to XSS    src/legacy.ts:12  
 4   SKY-D504   Critical   new Function() is equivalent to eval src/exec.ts:5  
 5   SKY-D506   High       child_process.exec() command inject  src/run.ts:41  
  
────────────────────── Quality Issues ─────────────────────────  
 #   Rule       Severity   Message                             Location  
 1   SKY-Q601   Medium     Function 'processData' complexity 18 src/processor.ts:30  
 2   SKY-Q602   Medium     Function 'handle' nesting depth 6    src/handler.ts:15  
 3   SKY-Q603   Low        Function 'init' is 85 lines long     src/setup.ts:10  
 4   SKY-Q604   Low        Function 'configure' has 8 params    src/config.ts:22  
```

--------------------------------

### Identify Unused Imports

Source: https://docs.skylos.dev/concepts/dead-code

Example of unused library imports that unnecessarily increase startup time and bundle size.

```python
# Each import adds to startup time  
import pandas  # Unused - but still loads 100MB library  
import numpy   # Unused  
import tensorflow  # Unused  
```

--------------------------------

### Verify Skylos Installation

Source: https://docs.skylos.dev/installation

Checks the installed version of the Skylos CLI.

```bash
skylos --version
```

--------------------------------

### Initialize and Validate Contracts

Source: https://docs.skylos.dev/ai-contracts

Commands to generate a starter contract file and verify its structure.

```bash
skylos contract init  
skylos contract validate .skylos/ai-contract.yml  
```

--------------------------------

### Context-Aware Penalty Application

Source: https://docs.skylos.dev/framework-awareness

Examples showing how penalties for test patterns vary depending on whether the file is identified as a test file.

```python
# In a test file (tests/test_user.py):  
def test_login():  # 100 - 40 = 60% (full penalty)  
    pass  
  
# In a non-test file (app.py):  
def test_login():  # 100 - 10 = 90% (penalty / 4)  
    pass  
```

--------------------------------

### Reproduce Benchmark Results

Source: https://docs.skylos.dev/case-studies

Commands to run the benchmark scripts for a specific repository within the demo environment.

```bash
cd real_life_examples/{repo}  
python3 ../benchmark_{repo}.py
```

--------------------------------

### Initialize CI/CD Workflow

Source: https://docs.skylos.dev/

Generate a GitHub Actions workflow file for Skylos.

```bash
skylos cicd init  
```

--------------------------------

### Verify and Install Skylos

Source: https://docs.skylos.dev/mcp-server

Commands to verify the Python environment and install the Skylos package to resolve module errors.

```bash
# Check which python  
which python  
  
# Install skylos there  
python -m pip install skylos  
  
# Or use absolute path in config  
/Users/you/venv/bin/python -m skylos_mcp.server  
```

--------------------------------

### Configure API Keys

Source: https://docs.skylos.dev/ai-features

Commands to set up API keys via the CLI or environment variables.

```bash
skylos key
```

```bash
# OpenAI  
export OPENAI_API_KEY="sk-..."  
  
# Anthropic  
export ANTHROPIC_API_KEY="sk-ant-..."
```

--------------------------------

### Migrating from Vulture

Source: https://docs.skylos.dev/why-skylos

Shows the command-line transition from Vulture to Skylos for confidence-based analysis.

```bash
# Before  
vulture myproject/ --min-confidence 80  
  
# After  
skylos myproject/ --confidence 80  
```

--------------------------------

### Deterministic Cleanup Operations

Source: https://docs.skylos.dev/cli-reference

Examples of using the clean command to preview or apply automated code cleanup with specific confidence levels and types.

```bash
# Preview safe import/function cleanup edits without writing files  
skylos clean . --dry-run --types import,function --confidence 80  
  
# Apply the same kind of cleanup without prompting  
skylos clean . --apply --types imports --confidence 80  
  
# Comment out matches instead of removing them  
skylos clean . --apply --comment-out --types import,function --confidence 80  
```

--------------------------------

### Recommended debt workflow

Source: https://docs.skylos.dev/technical-debt

Standard sequence of commands for managing project debt.

```bash
# 1. Get a full project debt picture
skylos debt .

# 2. Save a baseline once the repo is in an acceptable state
skylos debt . --save-baseline

# 3. Review active work without distorting repo score
skylos debt . --changed

# 4. Check whether hotspots are getting worse over time
skylos debt . --baseline

# 5. Review saved debt score history and latest hotspot locations
skylos debt . --show-history
```

--------------------------------

### Initialize CI/CD Workflow with Defense

Source: https://docs.skylos.dev/ai-defense

Use these commands to generate or update your GitHub Actions workflow with AI Defense steps.

```bash
skylos cicd init --defend  
skylos cicd init --defend --upload     # also upload results to cloud  

```

--------------------------------

### Check Code Complexity

Source: https://docs.skylos.dev/concepts/vibe-coding

Command to flag over-engineered functions and example output.

```bash
skylos . --quality  
```

```text
SKY-Q301: Function 'sum_numbers' has complexity 6 (threshold: 10)  
SKY-Q304: Function 'parse_config' has 5 parameters (threshold: 5)  
```

--------------------------------

### Scaffold workflow files with skylos cicd init

Source: https://docs.skylos.dev/ci-cd

Use these commands to scaffold workflow files. Note that --upload generates a token-based workflow and does not support OIDC.

```bash
skylos cicd init  
skylos cicd init --upload  
skylos cicd init --defend  
skylos cicd init --defend --upload  
```

--------------------------------

### Perform Security Scanning

Source: https://docs.skylos.dev/concepts/vibe-coding

Command to scan for security vulnerabilities and example output.

```bash
skylos . --danger  
```

```text
SKY-D210 CRITICAL: SQL injection in api/users.py:45  
SKY-D212 CRITICAL: Command injection in utils/shell.py:12  
```

--------------------------------

### Perform Initial Scan

Source: https://docs.skylos.dev/guides/legacy-codebase

Run an initial analysis of the codebase and export the results to a JSON file.

```bash
skylos . --json -o baseline.json  
```

--------------------------------

### Initialize Skylos Configuration

Source: https://docs.skylos.dev/installation

Generates a default configuration in the project root's pyproject.toml file.

```bash
skylos init
```

--------------------------------

### View secret detection output

Source: https://docs.skylos.dev/security-analysis

Example of the terminal output generated by the secret scanner.

```text
──────────────────────── Secrets ────────────────────────  
 #  Provider  Message                    Preview           Location  
 1  aws       AWS Access Key detected    AKIA****EXAMPLE   config.py:12  
 2  stripe    Stripe Live Key detected   sk_live_****xyz   payments.py:8  
```

--------------------------------

### Configure Cloud Provider API Keys

Source: https://docs.skylos.dev/ai-features

Set environment variables to authenticate with cloud-based LLM providers.

```bash
export OPENAI_API_KEY="sk-..."  
# or  
export ANTHROPIC_API_KEY="sk-ant-..."  
```

--------------------------------

### Cross-Reference Logic

Source: https://docs.skylos.dev/smart-tracing

Example of how Skylos matches static definitions against recorded trace data.

```text
Definition: visit_FunctionDef at visitor.py:42  
Trace: visit_FunctionDef at visitor.py:42 (called 156 times)  
Result: Mark as used  
```

--------------------------------

### Migrating from Pylint

Source: https://docs.skylos.dev/why-skylos

Shows the command-line transition from Pylint complexity checks to Skylos quality metrics.

```bash
# Before  
pylint myproject/ --disable=all --enable=R0912,R0915  
  
# After  
skylos myproject/ --quality  
```

--------------------------------

### Connect CLI in Headless Environments

Source: https://docs.skylos.dev/authentication

Use these commands to authenticate when browser-based login is unavailable.

```bash
skylos sync connect
```

```bash
SKYLOS_TOKEN=sk_live_xxx... skylos . --upload
```

--------------------------------

### Initialize AI Contract

Source: https://docs.skylos.dev/cli-reference

Creates a .skylos/ai-contract.yml file to define repository-specific guardrails for generated code.

```bash
skylos contract init
```

--------------------------------

### Simplify Code Logic

Source: https://docs.skylos.dev/concepts/vibe-coding

Example of replacing verbose AI-generated code with concise Python.

```python
# AI gave you 30 lines for summing  
# You need:  
total = sum(numbers)  
```

--------------------------------

### skylos init

Source: https://docs.skylos.dev/cli-reference

Initializes the Skylos configuration in the current directory by creating or updating the [tool.skylos] section in pyproject.toml.

```APIDOC
## skylos init

### Description
Initializes Skylos configuration in the current directory. This command creates or appends a [tool.skylos] section to the project's pyproject.toml file with default settings.
```

--------------------------------

### Identify Runtime Uncertainty

Source: https://docs.skylos.dev/concepts/static-analysis

Example of dynamic function calls that cannot be resolved during static analysis.

```python
# dynamic_call(func_name):  
    func = getattr(module, func_name)  # Which function? Unknown at static time.  
    func()  
```

--------------------------------

### Run Test Suite

Source: https://docs.skylos.dev/guides/legacy-codebase

Execute the full test suite to ensure that commenting out the functions did not break existing functionality.

```bash
# Or your full CI command  
make test  
```

--------------------------------

### Detect Semantic Issues

Source: https://docs.skylos.dev/concepts/static-analysis

Example of identifying undefined functions or typos during semantic analysis.

```python
# Semantic issue: calling undefined function  
def main():  
    result = proccess_data(x)  # Typo: 'proccess' not defined  
```

--------------------------------

### Define Custom Entrypoints

Source: https://docs.skylos.dev/dead-code-detection

Add project-specific entrypoint rules in the configuration file to mark methods or functions as live when they are invoked by frameworks or decorators.

```toml
[[tool.skylos.dead_code.entrypoints]]  
type = "method"  
name = ["create", "pre_hook", "post_hook"]  
parent = { name = "Main", base_classes = ["Application"] }  
reason = "project framework lifecycle hook"  
  
[[tool.skylos.dead_code.entrypoints]]  
type = "function"  
decorators = ["runtime_hook"]  
path = "src/**"  
reason = "registered by runtime_hook"
```

--------------------------------

### Deploy to Staging

Source: https://docs.skylos.dev/guides/legacy-codebase

Commit the changes and push to a staging environment for final verification.

```bash
git commit -m "chore: comment out potentially dead functions"  
git push origin cleanup/dead-code-removal  
# Deploy to staging  
```

--------------------------------

### Initialize and apply AI hallucination contracts

Source: https://docs.skylos.dev/ai-features

Set up a contract for generated code and apply it during verification to catch AI-specific defects.

```bash
skylos contract init  
skylos verify . --contract .skylos/ai-contract.yml  
skylos verify . --file apps/api/routes.py --project-context --contract .skylos/ai-contract.yml  
```

--------------------------------

### Migrating from Bandit

Source: https://docs.skylos.dev/why-skylos

Shows the command-line transition from Bandit to Skylos for security analysis.

```bash
# Before  
bandit -r myproject/ -f json -o bandit.json  
  
# After  
skylos myproject/ --danger --json -o skylos.json  
```

--------------------------------

### Jenkins Pipeline Configuration

Source: https://docs.skylos.dev/ci-cd

Defines a Jenkins stage that retrieves credentials and executes the Skylos installation and scan.

```groovy
stage('Skylos Scan') {  
  environment {  
    SKYLOS_TOKEN = credentials('skylos-token')  
  }  
  steps {  
    sh 'pip install skylos'  
    sh 'skylos . --danger --quality --ai-defects --upload'  
  }  
}  
```

--------------------------------

### Basic CLI Usage

Source: https://docs.skylos.dev/cli-reference

General syntax for running Skylos commands on a specific path.

```bash
skylos <path> [options]
```

--------------------------------

### Project structure for mixed-language analysis

Source: https://docs.skylos.dev/typescript-support

Example directory layout for a project containing both Python and TypeScript components.

```text
my-project/  
├── backend/  # Python - fully analyzed  
│   ├── api/  
│   └── models/  
├── frontend/  # TypeScript - analyzed  
│   ├── src/  
│   └── components/  
└── pyproject.toml  
```

--------------------------------

### Flag TypeScript Functions with Excessive Parameters

Source: https://docs.skylos.dev/typescript-support

Example of a function exceeding the default limit of 5 parameters.

```typescript
// Flagged if > 5 parameters (default)  
function configure(a: string, b: number, c: boolean, d: object, e: string[], f: Map<string, any>) {  
  // ...  
}  
```

--------------------------------

### Flag Long TypeScript Functions

Source: https://docs.skylos.dev/typescript-support

Example of a function that would be flagged if it exceeds the default 50-line limit.

```typescript
// Flagged if > 50 lines (default)  
function longFunction() {  
  // ... 60 lines of code  
}  
```

--------------------------------

### Project Configuration File Path

Source: https://docs.skylos.dev/project-policy

The primary configuration file for synced project settings.

```yaml
.skylos/config.yaml
```

--------------------------------

### View Applied Penalties JSON

Source: https://docs.skylos.dev/guides/penalty-system

Example structure of the JSON output showing applied penalties and reasons.

```json
{
  "whitelisted": [  
    {  
      "name": "handle_event",  
      "file": "handlers.py",  
      "line": 42,  
      "reason": "matches 'handle_*'"  
    },  
    {  
      "name": "User.name",  
      "file": "models.py",   
      "line": 15,  
      "reason": "Pydantic model field"  
    }  
  ]  
}
```

--------------------------------

### Authenticate with Cloud

Source: https://docs.skylos.dev/cloud

Connects the current repository to a Skylos cloud project.

```bash
skylos login
```

--------------------------------

### Check Credit Balance via CLI

Source: https://docs.skylos.dev/billing

Run this command to view current credit balance, plan status, and recent transaction history.

```bash
skylos credits
```

```text
[My Org] (pro plan — expires 2026-06-15)  
Balance: 1,500 credits  
  
Recent activity:  
  +2500   Purchased 2500 credits (builder pack)  
  -1      Scan upload  
  -5      AI issue triage  
  -10     AI code remediation  
  
Buy credits: https://skylos.dev/dashboard/billing
```

--------------------------------

### Taint Analysis Data Flow

Source: https://docs.skylos.dev/faq

Example showing how untrusted data flows from a source to a dangerous sink.

```python
user_id = request.args.get("id")                      # Source: tainted  
query = f"SELECT * FROM users WHERE id = {user_id}"   # Propagation  
cursor.execute(query)                                  # Sink: flagged  
```

--------------------------------

### Verify and Commit Changes

Source: https://docs.skylos.dev/guides/legacy-codebase

Run tests to ensure stability and commit the changes.

```bash
# Run tests  
pytest  
  
# If tests pass, commit  
git add -A  
git commit -m "chore: remove unused imports (47 files)"  
```

--------------------------------

### Detect AI-Specific Defects

Source: https://docs.skylos.dev/concepts/vibe-coding

Command to check for common AI-generated code failure modes and example output.

```bash
skylos . --ai-defects  
```

```text
SKY-L012: Phantom security helper call  
SKY-D224: Real package called with invented API  
SKY-A101: Test assertion weakened in this diff  
```

--------------------------------

### Calculate Cyclomatic Complexity Example

Source: https://docs.skylos.dev/code-quality

A function demonstrating multiple decision points that contribute to cyclomatic complexity.

```python
def process_order(order):   
    if not order.valid:  
        return None  
      
    if order.priority == 'high':  
        if order.value > 1000:  
            apply_discount(order)  
        notify_manager(order)  
    elif order.priority == 'medium':  
        queue_order(order)  
      
    for item in order.items:  
        if item.backordered:  
            handle_backorder(item)  
        elif item.fragile:   
            mark_fragile(item)  
      
    return order
```

--------------------------------

### Verify changes with tests

Source: https://docs.skylos.dev/dead-code-detection

Run the test suite to ensure that the cleanup process did not break existing functionality.

```bash
pytest  
```

--------------------------------

### Identify Unused Functions

Source: https://docs.skylos.dev/concepts/dead-code

Example of legacy code that remains in the codebase despite being superseded by newer implementations.

```python
# Developer sees this and wonders:  
# "Is this used? Should I update it too? What does it do?"  
  
def legacy_process(data):  # dead  
    # 50 lines of complex logic...  
    pass  
  
def process(data):  # used  
    # Different logic...  
    pass  
```

--------------------------------

### AI-defect JSON output structure

Source: https://docs.skylos.dev/ai-defects

Example of the JSON structure returned when AI-defect analysis identifies a finding.

```json
{
  "ai_defects": [
    {
      "rule_id": "SKY-D224",
      "category": "ai_defect",
      "defect_type": "api_signature_hallucination",
      "message": "Installed API does not accept keyword argument 'imaginary_timeout'."
    }
  ],
  "analysis_summary": {
    "ai_defects_count": 1
  }
}
```

--------------------------------

### Configure AI Provider Keys

Source: https://docs.skylos.dev/

Set environment variables for AI provider authentication.

```bash
export OPENAI_API_KEY="sk-..."  
```

```powershell
$env:OPENAI_API_KEY="sk-..."  
```

--------------------------------

### Check Python Version

Source: https://docs.skylos.dev/vscode

Command to verify the installed Python version, as Skylos requires Python 3.10 or higher.

```bash
python --version  
```

--------------------------------

### Enforce Contract Route Guards

Source: https://docs.skylos.dev/rules-reference

Defines required decorators for route handlers and provides an example of a non-compliant route.

```yaml
security:  
  routes:  
    paths:  
      - "apps/api/**"  
    require_any_decorator:  
      - login_required  
```

```python
@app.route("/admin")  
def admin_dashboard(request):  
    return {"status": "ok"}  
```

--------------------------------

### Deterministic cleanup preview and apply

Source: https://docs.skylos.dev/cli-reference

Previews and then applies cleanup operations for specific types with a confidence threshold.

```bash
skylos clean . --dry-run --types imports --confidence 80  
skylos clean . --apply --types imports --confidence 80  
```

--------------------------------

### Measure TypeScript Nesting Depth

Source: https://docs.skylos.dev/typescript-support

Example of calculating nesting depth based on nested control flow statements.

```typescript
// Nesting depth: 3 (flagged if limit is 4)  
function deep() {  
  if (a) {                    // depth 1  
    for (const x of items) {  // depth 2  
      if (x.ok) {             // depth 3  
        handle(x);  
      }  
    }  
  }  
}  
```

--------------------------------

### Preview deterministic cleanup

Source: https://docs.skylos.dev/dead-code-detection

Perform a dry run to preview changes for unused imports and functions with high confidence.

```bash
skylos clean . --dry-run --types import,function --confidence 80  
```

--------------------------------

### Identify SQL Injection Vulnerability

Source: https://docs.skylos.dev/concepts/vibe-coding

Example of code that passes linting but contains a critical SQL injection vulnerability.

```python
# Passes all linters!  
def process(user_id):  
    query = f"SELECT * FROM users WHERE id = {user_id}"  # SQL injection  
    return db.execute(query)  
```

--------------------------------

### Manage Whitelist via CLI

Source: https://docs.skylos.dev/configuration

Commands to add, document, and view whitelist patterns directly from the terminal.

```bash
# Add a glob pattern  
skylos whitelist 'handle_*'  
  
# Add with reason (recommended for teams)  
skylos whitelist dark_logic --reason "Called via globals() in dispatcher"  
  
# View current whitelist  
skylos whitelist --show  
```

--------------------------------

### Skylos Quality Report Output

Source: https://docs.skylos.dev/code-quality

Example of the tabular output generated when running Skylos with the --quality flag.

```text
────────────────────────── Quality Issues ──────────────────────────  
 #   Type        Name                  Detail                           Location  
 1   Complexity  process_order         Complexity: 18 (max 10)          orders.py:45  
 2   Nesting     validate_input        Deep nesting: depth 6            validators.py:23  
 3   Structure   generate_report       Line count: 142, 142 lines       reports.py:10  
 4   Quality     "lokal"               repeated 12× (max 3)             PDF_in_Akte.py:588  
 5   Logic       create_cache          Mutable default argument         cache.py:5  
 6   Typing      create_user           missing return annotation        users.py:12  
 7   Framework Security create_user    mutating route has no auth guard api.py:34  
```

--------------------------------

### skylos cicd init

Source: https://docs.skylos.dev/cli-reference

Generates a GitHub Actions workflow file for automated scanning.

```APIDOC
## skylos cicd init

### Description
Generate a GitHub Actions workflow file for automated scanning.

### Parameters
- **--python-version** (string) - Optional - Python version for the workflow (Default: 3.12)
- **--triggers** (string) - Optional - GitHub event triggers (Default: pull_request push)
- **--analysis** (string) - Optional - Analysis types to enable (Default: dead-code security quality secrets)
- **--no-baseline** (boolean) - Optional - Skip baseline comparison (Default: false)
- **--llm** (boolean) - Optional - Include LLM-enhanced analysis (Default: false)
- **--model** (string) - Optional - LLM model to use with --llm
- **--upload** (boolean) - Optional - Include --upload step to send scan results to the Skylos cloud dashboard. Requires SKYLOS_TOKEN in repo secrets.
- **--output, -o** (string) - Optional - Output file path (Default: .github/workflows/skylos.yml)
```

--------------------------------

### Identify Excessive Nesting Depth

Source: https://docs.skylos.dev/code-quality

Example of code exceeding recommended nesting levels, making it difficult to follow.

```python
# Depth 5 - Very hard to follow  
def bad_example():  
    if condition1:              # 1st level  
        for item in items:      # 2nd level  
            if condition2:      # 3rd level  
                try:            # 4th level  
                    if condition3:  # 5th level (RIP)  
                        process(item)  
                except:  
                    pass
```

--------------------------------

### Basic Upload Command

Source: https://docs.skylos.dev/cloud-workflow

Performs a standard scan upload to Skylos Cloud.

```bash
skylos . --upload  
```

--------------------------------

### Detect Data Flow Issues

Source: https://docs.skylos.dev/concepts/static-analysis

Example of tracking variable values to identify potential null pointer exceptions.

```python
# Data flow issue: variable might be None  
def get_user(id):  
    user = db.find(id)  # Returns User or None  
    return user.name    # user might be None!  
```

--------------------------------

### Connect API Key to Repository

Source: https://docs.skylos.dev/authentication

Commands to link an API key to the current repository, either by passing it as an argument or interactively.

```bash
skylos sync connect sk_live_xxx...  
```

```bash
skylos sync connect  
```

--------------------------------

### Detect Syntactic Issues

Source: https://docs.skylos.dev/concepts/static-analysis

Examples of linting checks for code style and structural issues like unused imports.

```python
# Syntactic issues  
import os    # unused import - linter catches this  
x=1+2        # spacing violation - linter catches this  
```

--------------------------------

### Configure Headless Authentication

Source: https://docs.skylos.dev/cloud-workflow

Connect to the cloud without a browser by providing an API key directly or using the sync connect command.

```bash
skylos sync connect  
# or  
skylos sync connect sk_live_xxx...  
```

--------------------------------

### GitLab CI Configuration

Source: https://docs.skylos.dev/ci-cd

Defines a job in .gitlab-ci.yml using the Python 3.11 image to install and run the Skylos scanner.

```yaml
skylos:  
  image: python:3.11  
  script:  
    - pip install skylos  
    - skylos . --danger --quality --ai-defects --upload  
  variables:  
    SKYLOS_TOKEN: $SKYLOS_TOKEN  
```

--------------------------------

### Measure TypeScript Function Complexity

Source: https://docs.skylos.dev/typescript-support

Example of cyclomatic complexity calculation where control flow nodes increment the complexity score.

```typescript
// Complexity: 4  
function process(data: Data) {  
  if (data.valid) {           // +1  
    for (const item of data.items) {  // +1  
      if (item.active) {      // +1  
        handle(item);  
      }  
    }  
  }  
}  
```

--------------------------------

### Connect Skylos to LM Studio

Source: https://docs.skylos.dev/ai-features

Configure the Skylos agent to communicate with a local server running in LM Studio.

```bash
skylos agent scan ./src \
  --provider openai \
  --base-url http://localhost:1234/v1 \
  --model codellama-13b-instruct  
```

--------------------------------

### Detect SQL Injection Vulnerabilities

Source: https://docs.skylos.dev/security-analysis

Examples of vulnerable SQL query construction versus secure parameterized query implementations.

```python
# Vulnerable - Skylos catches all of these  
  
# Direct concatenation  
cursor.execute("SELECT * FROM users WHERE id = " + user_id)  
  
# F-string interpolation    
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")  
  
# .format() method  
cursor.execute("SELECT * FROM users WHERE id = {}.format(user_id))")  
  
# SQLAlchemy text()  
from sqlalchemy import text  
session.execute(text(f"SELECT * FROM t WHERE x = {val}"))  
  
# Django raw()  
User.objects.raw(f"SELECT * FROM users WHERE name = '{name}'")
```

```python
# Safe - parameterized queries  
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))  
session.execute(text("SELECT * FROM t WHERE x = :val"), {"val": val})  
User.objects.raw("SELECT * FROM users WHERE name = %s", [name])
```

--------------------------------

### Enable Runtime Tracing

Source: https://docs.skylos.dev/framework-awareness

Use the --trace flag to cross-reference static analysis with runtime data for dynamic patterns.

```bash
skylos . --trace  # Run tests with tracing, then analyze  
```

--------------------------------

### MCP Server Interaction Flow

Source: https://docs.skylos.dev/mcp-server

Example of how an AI client interacts with the Skylos MCP server to perform a security scan.

```text
You: "Scan my project for security issues"  
Claude -> calls security_scan("./my-project")  
     -> Skylos runs full taint analysis, dangerous-call detection, etc.  
     -> Returns structured findings  
Claude: "I found 3 issues: SQL injection on line 42, SSRF on line 87, ..."  
```

--------------------------------

### View Skylos Scan Results

Source: https://docs.skylos.dev/vscode

Example output format displayed in the VS Code Output panel after a workspace scan.

```text
============================================================  
DETAILED RESULTS  
============================================================  
  
SECURITY  
------------------------------------------------------------  
  
  HIGH (1)  
 1. [DANGER-001] Use of eval() with user input  
    File: app/utils.py:42  
  
DEAD CODE  
------------------------------------------------------------  
  
  INFO (3)  
 1. Unused import: os  
    File: app/main.py:2  
 2. Unused function: deprecated_handler  
    File: app/views.py:89  
 3. Unused variable: temp  
    File: app/models.py:156  
  
============================================================  
Total: 4 issue(s)  
```

--------------------------------

### Run Verification with Contracts

Source: https://docs.skylos.dev/ai-contracts

Execute verification against a codebase or specific file using a defined contract.

```bash
skylos verify . --contract .skylos/ai-contract.yml  
skylos verify . --file apps/api/routes.py --project-context --contract .skylos/ai-contract.yml  
```

--------------------------------

### Run basic debt scans

Source: https://docs.skylos.dev/technical-debt

Execute full project scans or filter output using CLI flags.

```bash
# Full project debt scan
skylos debt .

# Machine-readable output
skylos debt . --json

# Show only the top 10 hotspots in table output
skylos debt . --top 10
```

--------------------------------

### Confidence Penalty Calculation

Source: https://docs.skylos.dev/framework-awareness

Examples showing how confidence scores are adjusted based on naming patterns and dynamic module penalties.

```python
# File has eval() somewhere, so dynamic_module penalty applies  
  
def handle_secret():  # 100 - 20 (handle_*) - 10 (dynamic) = 70%  
    pass  
  
def visit_Name():     # 100 - 25 (visit_*) - 10 (dynamic) = 65%  
    pass  
  
def totally_dead():   # 100 - 10 (dynamic) = 90%  
    pass  
```

--------------------------------

### Django Method Base Class Check

Source: https://docs.skylos.dev/framework-awareness

Examples demonstrating how framework base classes influence whether a method is skipped.

```python
# This is skipped (correct base class)  
class UserView(APIView):  
    def get(self, request):  # confidence = 0%  
        pass  
  
# This is NOT skipped (no framework base)  
class Helper:  
    def get(self, request):  # confidence = 100% (flagged)  
        pass  
```

--------------------------------

### Run AI-Code Defect Benchmarks

Source: https://docs.skylos.dev/ai-features

Execute the benchmark harness to validate AI-defect rules and detection logic.

```bash
python scripts/ai_code_defect_benchmark.py  
python scripts/ai_code_defect_benchmark.py --json  
python scripts/ai_code_defect_benchmark.py --case dependency-version-hallucination  
```

--------------------------------

### Configure MCP server with API key

Source: https://docs.skylos.dev/mcp-server

Add the SKYLOS_API_KEY environment variable to enable full tool access.

```json
{
  "mcpServers": {
    "skylos": {
      "command": "python",
      "args": ["-m", "skylos_mcp.server"],
      "env": {
        "SKYLOS_API_KEY": "your-api-key-here"
      }
    }
  }
}

```

--------------------------------

### Complexity Calculation Example

Source: https://docs.skylos.dev/guides/how-it-works

Demonstrates how the complexity calculator increments scores based on decision points like conditionals and loops.

```python
    if x > 0:           # +1 = 2  
        for i in y:     # +1 = 3  
            if i:       # +1 = 4  
                pass  
    return x            # Total: 4  
```
Tokens:
Raw