# Skylos

> Open source Python static analysis and security scanner for dead code, secrets, GitHub Actions, MCP guardrails, and AI-generated code review.

## Positioning
- Skylos is primarily positioned on this site for Python security and static analysis workflows.
- Content is written for developers evaluating Bandit, Semgrep, CodeQL, Snyk, SonarQube, Vulture, and adjacent tools.
- The site emphasizes extractable answers: direct intros, methodology, benchmarks, FAQs, comparison pages, and AI-agent workflow guides.

## Priority Query Clusters
- python static analysis tool
- python security scanner
- dead code detection python
- python security scanner github actions
- secure github actions python
- ai generated code security python
- secure mcp server
- claude code security review
- cursor security scanner
- github copilot security review
- ai security regression detection
- llm application security scanner
- python.linting deprecated vscode
- bandit vs codeql vs semgrep python
- semgrep alternative python
- vulture alternative python

## Core Site Pages
- [Home](https://skylos.dev/): Product overview and benchmark proof
- [Docs](https://docs.skylos.dev/): Getting started, installation, and product documentation
- [Rules Reference](https://docs.skylos.dev/rules-reference): Rule catalog and scanner behavior reference
- [Blog](https://skylos.dev/blog): Research-backed articles
- [Compare](https://skylos.dev/compare): Comparison hub
- [Use Cases](https://skylos.dev/use-cases): Workflow guides
- [VS Code](https://skylos.dev/vscode): VS Code extension landing page
- [Roadmap](https://skylos.dev/roadmap): Product roadmap
- [Sitemap](https://skylos.dev/sitemap.xml): XML sitemap
- [RSS](https://skylos.dev/blog/feed.xml): Blog feed

## Documentation Surface
- [Docs](https://docs.skylos.dev/): Primary install, quickstart, and configuration entrypoint
- [Rules Reference](https://docs.skylos.dev/rules-reference): Best external reference for rule-level explanations and lookup intent

## Comparison Inventory
- [Bandit vs CodeQL vs Semgrep for Python Security Scanning](https://skylos.dev/compare/bandit-vs-codeql-vs-semgrep-python): Bandit, CodeQL, and Semgrep all scan Python, but they solve different problems. This comparison covers rule depth, customization, GitHub fit, and where each tool is strongest. Keywords: bandit vs codeql vs semgrep python, bandit vs semgrep python, codeql vs semgrep python, best python security scanner, python sast tools comparison, python code scanning tools.
- [Bandit vs Skylos: Which Python Security Scanner Should You Use?](https://skylos.dev/compare/bandit-vs-skylos): A detailed comparison of Bandit and Skylos for Python security scanning. Where Bandit has the edge, where Skylos is stronger, and which one fits your workflow in 2026. Keywords: bandit vs skylos, bandit alternative, bandit alternative 2026, python security scanner, python sast tool, bandit python security.
- [Snyk vs Skylos: Python Security Comparison](https://skylos.dev/compare/snyk-vs-skylos): Compare Snyk and Skylos for Python security. Where Snyk dominates, where Skylos fills the gaps, and why many teams run both. Keywords: snyk alternative, snyk vs skylos, snyk alternative open source, snyk alternative free, python sast free, snyk code alternative.
- [SonarQube vs Skylos for Python (2026)](https://skylos.dev/compare/sonarqube-vs-skylos): Compare SonarQube and Skylos for Python static analysis. Enterprise governance vs focused AI code security, dead code detection, and quality. Keywords: sonarqube alternative, sonarqube alternative open source, sonarqube vs skylos, sonarqube alternative python, sonarqube lightweight alternative, sonarqube alternative for small teams.
- [Best Python SAST Tools in 2026 Compared](https://skylos.dev/compare/best-python-sast-tools-2026): Compare the top Python SAST tools in 2026: Semgrep, Bandit, CodeQL, Vulture, and Skylos. See which tool fits security scanning, dead code detection, CI, and AI-generated Python code review. Keywords: best python SAST tools 2026, python static analysis tools, python security scanner comparison, semgrep vs bandit vs codeql, best python security tool, python SAST comparison.
- [Deadcode vs Vulture vs Skylos for Python Dead Code Detection](https://skylos.dev/compare/deadcode-vs-vulture-vs-skylos): Compare deadcode, Vulture, and Skylos for Python dead code detection. See autofix, false positives, framework awareness, CI workflow, and when each tool fits. Keywords: deadcode vs vulture, python dead code detection tools, best dead code tool python, vulture alternative python, deadcode python, find unused code python.
- [Semgrep vs Skylos: Which Python SAST Tool Should You Use?](https://skylos.dev/compare/semgrep-vs-skylos): A detailed comparison of Semgrep and Skylos for Python static analysis. Where Semgrep has the edge, where Skylos is stronger, and which one fits your workflow. Keywords: semgrep vs skylos, semgrep alternative python, semgrep python comparison, python sast tools, semgrep alternative, best python security scanner.

## Use Case Inventory
- [GitHub Actions Security Scanner for CI/CD Supply Chain Risk](https://skylos.dev/use-cases/github-actions-security-scanner): Use Skylos to catch risky GitHub Actions patterns before merge: privileged triggers, broad permissions, unpinned actions, unsafe secrets, OIDC misuse, and dependency install scripts. Keywords: github actions security scanner, github actions static analysis, github actions sast, ci cd supply chain security, github actions workflow security, pull_request_target security.
- [How to Secure GitHub Actions for Python Repos](https://skylos.dev/use-cases/secure-github-actions-python): Secure GitHub Actions for Python by pinning third-party actions, locking down GITHUB_TOKEN permissions, using OIDC, and scanning every pull request for Python security issues. Keywords: secure github actions python, github actions security python, python github actions hardening, pin actions full length sha, github token permissions least privilege, github actions oidc python.
- [How to Secure an MCP Server Before You Trust It With Your Code](https://skylos.dev/use-cases/secure-mcp-server): MCP makes AI coding agents far more useful, but it also expands what they can read, call, and exfiltrate. Use this checklist to harden MCP servers before they touch your repo, shell, or secrets. Keywords: secure mcp server, model context protocol security, mcp security checklist, claude code mcp security, cursor mcp security, mcp server permissions.
- [How to Review Claude Code Output for Python Security Regressions](https://skylos.dev/use-cases/claude-code-security-review): Claude Code's permission model is a strong start, but approved edits can still remove auth checks, relax validation, or introduce insecure shortcuts. This workflow adds static verification before those changes merge. Keywords: claude code security review, claude code security, review claude code output, claude code python security, claude code static analysis, ai coding assistant security review.
- [How to Use Skylos as a Cursor Security Scanner for Python](https://skylos.dev/use-cases/cursor-security-scanner): Cursor can write code quickly, call MCP tools, and run with approvals or auto-run. This workflow adds local scanning, pre-commit checks, and PR gating so speed does not turn into silent risk. Keywords: cursor security scanner, cursor code security, cursor python security scanner, cursor static analysis, cursor ai code review, cursor generated code security.
- [How to Catch Removed Auth Checks and Security Regressions in AI-Generated PRs](https://skylos.dev/use-cases/ai-security-regressions-in-prs): The most dangerous AI-generated vulnerability is often not new code. It is a deleted decorator, dropped validation check, or missing middleware in a clean-looking refactor. Diff-aware scanning is how you catch it. Keywords: ai security regression detection, removed auth checks, ai generated pr security, secure ai generated pull requests, diff aware security scan, detect removed decorators python.
- [How to Scan LLM Applications for Prompt Injection, Data Leaks, and Missing Guardrails](https://skylos.dev/use-cases/llm-application-security-scanning): If your product calls LLMs, the risky part is not just the prompt. It is the surrounding system: tools, retrieval, output handling, tenant boundaries, and cost controls. This guide shows how to scan that surface. Keywords: llm application security scanner, prompt injection scanner, llm security scanning, owasp llm top 10 scanner, agentic ai security, rag security scanning.
- [How to Review GitHub Copilot Output for Python Security and Regressions](https://skylos.dev/use-cases/github-copilot-security-review): GitHub Copilot can now review pull requests and follow repository guidelines, but you still need static analysis to catch dead code, insecure patterns, and removed protections in AI-generated Python changes. Keywords: github copilot security review, copilot code review security, review copilot output python, github copilot python security, copilot generated code security, ai code review security python.
- [How to Verify AI-Generated Python Code and Catch Hallucinated Imports](https://skylos.dev/use-cases/ai-generated-code-security): Learn how to verify AI-generated Python code before merge. Catch hallucinated imports, phantom calls, hardcoded secrets, and disabled security controls before they reach production. Keywords: hallucinated imports python, ai generated code security, phantom function calls, ai code scanner python, copilot generated bugs, ai code review tool.
- [How to Detect Dead Code in Python](https://skylos.dev/use-cases/detect-dead-code-python): Dead code accumulates silently in every Python project. Here's how to find unused functions, unreachable code, and phantom imports — especially in codebases that use AI coding tools. Keywords: detect dead code python, find unused functions python, python dead code detection, unused imports python, unreachable code python, python code cleanup.
- [Python Security Scanner for GitHub Actions: Scan Every Pull Request](https://skylos.dev/use-cases/python-security-github-actions): Add a Python security scanner to GitHub Actions and scan every pull request. Catch dead code, hardcoded secrets, SQL injection, and AI-generated code problems before merge. Keywords: python security scanner github actions, python SAST github action, python static analysis CI CD, github action python security, python security scanning CI, automated python security scan.

## Blog Inventory
- [GitHub Actions PR Gate for AI-Generated Code: A Practical Security Workflow](https://skylos.dev/blog/github-actions-ai-generated-code-pr-gate): A practical GitHub Actions workflow for AI-generated code: scan changed code, avoid pull_request_target traps, limit token permissions, catch secrets, and block removed auth or validation before merge. Keywords: github actions ai generated code, ai generated code pr gate, ai code security github actions, github actions security gate, pull request security gate, ai pull request security.
- [Next.js SaaS Security Checklist: 9 Bugs We Fixed Before They Became Incidents](https://skylos.dev/blog/nextjs-saas-security-checklist): We hardened Skylos Cloud across auth, billing, analytics, Supabase RLS, public quotas, and scan ingestion. This is the practical Next.js SaaS security checklist we took from that work. Keywords: Next.js SaaS security checklist, SaaS security checklist, Supabase RLS security, Next.js security best practices, Supabase security best practices, billing entitlement security.
- [AI Coding Agent Security Checklist: 12 Controls Before Agents Open PRs](https://skylos.dev/blog/ai-coding-agent-security-checklist): AI coding agents can edit files, run commands, add dependencies, call tools, and open pull requests. Use this security checklist before you let Claude Code, Cursor, Codex, Copilot, Devin, or other agents work in production repositories. Keywords: ai coding agent security checklist, ai coding agent security, secure ai coding agents, agentic coding security, ai agent pull request security, claude code security checklist.
- [GitHub Actions Security and GitLab CI Security: Static Analysis for CI/CD](https://skylos.dev/blog/github-actions-gitlab-ci-security-static-analysis): Skylos now scans GitHub Actions and GitLab CI workflows for CI/CD supply-chain risk: dangerous triggers, unpinned actions and includes, OIDC misuse, Docker-in-Docker TLS gaps, cache restore, unsafe secrets, and missing timeouts. Keywords: github actions security, github actions security scanner, gitlab ci security, gitlab ci security scanner, ci cd security, ci cd supply chain security.
- [Why AI-Generated Python Code Is Insecure in 2026 (And What Static Analysis Actually Catches)](https://skylos.dev/blog/why-ai-generated-python-code-is-insecure-2026): Veracode's late-2025 GenAI Code Security Report and its Spring 2026 update keep landing on the same number: around 45 percent of AI-generated code ships with security flaws. Python was around 38 percent in Veracode's October 2025 language breakdown, while Python, C#, and JavaScript clustered in the 38 to 45 percent band. Here is what is actually breaking, why review tools miss it, and the static analysis gates that stop it before merge. Keywords: why ai generated code is insecure, ai generated python code vulnerabilities, ai code vulnerability statistics 2026, ai generated code security risks, python ai code security, vibe coding vulnerabilities.
- [AI Code Review for Security: A PR Checklist for Auth, Tenant Isolation, Validation, and Secrets](https://skylos.dev/blog/ai-code-review-security-pr-checklist): A practical AI code review security checklist for PRs: catch removed auth, broken tenant isolation, missing validation, rate limits, audit logs, and secrets before merge. Keywords: ai code review security checklist, ai code review security, ai generated code security checklist, ai pull request security, secure ai generated code, catch removed auth checks.
- [I Tested Dead-Code Detection by Sending Cleanup PRs to Mature OSS Repos](https://skylos.dev/blog/dead-code-detection-oss-cleanup-prs): Dead-code scanners are easy to demo on toy projects and hard to trust in real Python repositories. We tested Skylos by sending small cleanup PRs to Black, NetworkX, Optuna, mitmproxy, pypdf, beets, and Flagsmith, then tracked what maintainers actually merged. Keywords: dead code detection python, python dead code scanner, static analysis false positives, vulture alternative python, python unused code detection, open source dead code cleanup.
- [Best AI Code Security Tools in 2026 Compared](https://skylos.dev/blog/best-ai-code-security-tools-2026): A practical comparison of the AI code security tools teams are actually evaluating in 2026: Claude Security, GitHub Copilot code review, Semgrep, Snyk Code, CodeQL, and Skylos. See which tool fits AI-generated PR review, Python workflows, CI gating, and secure vibe coding. Keywords: best ai code security tools 2026, ai code security tools, secure vibe coding tools, ai generated code security tools, ai code review security, claude security alternative.
- [Flask Security Scanning: What Static Analysis Actually Catches in 2026](https://skylos.dev/blog/flask-security-scanning-what-static-analysis-catches): Flask gives you flexibility, but that flexibility means more security decisions land in your own code. Here are 7 real Flask vulnerability patterns static analysis can catch — from SQL injection and SSTI to path traversal and unsafe subprocess calls. Keywords: flask security scanning, flask static analysis, flask vulnerability scanner, flask SAST, flask security best practices 2026, flask SQL injection detection.
- [Slopsquatting in Python: What 205,474 Hallucinated Package Names Mean for Your Supply Chain](https://skylos.dev/blog/slopsquatting-python-hallucinated-imports): LLMs invent Python packages that don't exist. Attackers register them. Academic research shows 43% of hallucinated names recur on every re-run of the same prompt — turning a model quirk into a repeatable attack surface. Here's what the peer-reviewed data says, and how to catch hallucinated imports at PR time. Keywords: slopsquatting, slopsquatting python, python package hallucination, ai hallucinated imports, llm package hallucination python, pypi supply chain attack ai.
- [`python.linting` Is Deprecated in VS Code: What Python Teams Should Use Now](https://skylos.dev/blog/python-linting-deprecated-vscode): VS Code deprecated the old python.linting settings in favor of dedicated tool extensions. Here is the practical replacement stack for Ruff, Pylint, Mypy, and Python security scanning. Keywords: python.linting deprecated, python linting deprecated vscode, vs code python linting, vscode python linter, python linting extension vscode, ruff vscode python.
- [3 Merged PRs: Dead Code We Found in Black, Flagsmith, and pypdf](https://skylos.dev/blog/3-merged-prs-dead-code-in-black-flagsmith-pypdf): We ran Skylos on popular open source Python projects, submitted pull requests to remove dead code, and all three were merged by maintainers. Here's what we found, how the LLM verification agent worked, and what the maintainers said. Keywords: dead code detection, dead code removal python, python static analysis, skylos dead code, black formatter dead code, pypdf dead code.
- [FastAPI Security Scanning: 8 Vulnerability Patterns Static Analysis Catches](https://skylos.dev/blog/fastapi-security-scanning-vulnerabilities-static-analysis): FastAPI's async-first design and Pydantic validation prevent some bugs but introduce others. Here are 8 real vulnerability patterns in FastAPI applications — from SSRF in background tasks to Pydantic validation bypass — and how to detect them with static analysis. Keywords: fastapi security scanning, fastapi static analysis, fastapi vulnerability scanner, fastapi security best practices, fastapi SAST, fastapi SQL injection.
- [Django Security Scanning: What Static Analysis Actually Catches in 2026](https://skylos.dev/blog/django-security-scanning-what-static-analysis-catches): Django's ORM prevents SQL injection — until your code uses raw(), .extra(), or cursor.execute(). Here are 7 real vulnerability patterns in Django applications, which tools detect each one, and how to test them yourself. Keywords: django security scanning, django static analysis, django vulnerability scanner, django SAST tools, django security best practices 2026, bandit django security.
- [Best Python Static Analysis Tools Compared: Bandit vs Vulture vs Skylos (2026)](https://skylos.dev/blog/python-sast-comparison-2026): A side-by-side comparison of Python static analysis tools for security, dead code, framework awareness, speed, and CI/CD integration. Keywords: best python static analysis tools 2026, python static analysis tools comparison, bandit vs vulture vs skylos, bandit alternative python, vulture alternative python, best python SAST tool.
- [We Scanned 9 Popular Python Libraries for Security and Dead Code. Here's What We Found.](https://skylos.dev/blog/we-scanned-9-popular-python-libraries): We ran static analysis on FastAPI, Flask, Pydantic, Rich, Requests, httpx, Click, Starlette, and tqdm. The results: 1,800 security findings, 4,195 quality issues, and 730 pieces of dead code across 9 widely used Python packages. Keywords: python security scan results, static analysis popular python libraries, FastAPI security vulnerabilities, Pydantic dead code, Flask security scan, python SAST results 2026.
- [Finding Dead Code in Flask (71k Stars): Skylos vs Vulture Benchmark](https://skylos.dev/blog/flask-dead-code-case-study): We ran Skylos and Vulture on the Flask repository. Skylos found all 7 dead items with 12 false positives. Vulture found 6 but produced 260 false positives. Here's the full breakdown with real output. Keywords: flask dead code detection, vulture vs skylos benchmark, vulture alternative python, flask static analysis, find unused code python, dead code detection benchmark.
- [Dead Code in Python Isn't Just Tech Debt — It's a Security Liability](https://skylos.dev/blog/dead-code-security-liability): Every unused function in your Python codebase is attack surface you don't need. Here's how dead code creates real security risks, why it gets worse with AI-generated code, and how to detect and remove it systematically. Keywords: dead code security risk python, unused code vulnerability, python dead code removal, remove unused code python, dead code attack surface, technical debt security risk.
- [How AI-Generated PRs Are Overwhelming Code Review (and How to Fix It)](https://skylos.dev/blog/surviving-the-ai-pr-tsunami): AI generates code faster than teams can review it. Here's why the AI PR flood is breaking code review, and how to automate security and quality gates without turning senior engineers into lint bots. Keywords: AI code review bottleneck, automated code quality gates, AI pull request review, code review automation, engineering burnout AI code, automated security triage.
- [AI-Generated Python Code Is Shipping Vulnerabilities (2026 Data)](https://skylos.dev/blog/vibe-coding): LLMs write code fast but introduce security flaws. Here's why AI-generated Python code fails security checks, the most common vulnerability patterns from Copilot, Claude, and Cursor, and how to detect them with static analysis. Keywords: AI generated code security, AI generated code vulnerabilities, vibe coding security risks, LLM insecure code python, SAST for AI generated code, detect hallucinated imports.
- [Why Python SAST Tools Drown Teams in False Positives (and What Actually Works)](https://skylos.dev/blog/sast-false-positives-what-works): Static Application Security Testing is supposed to catch vulnerabilities before they ship. In practice, noisy SAST results often get ignored. Here's why, and how taint analysis and framework awareness fix it. Keywords: SAST false positives, reduce SAST noise python, static analysis false positive rate, python SAST tool comparison, taint analysis python, dataflow analysis SAST.

## Entity Facts
- Brand: Skylos
- Category: Python static analysis and security scanner
- Product surfaces: CLI, cloud dashboard, GitHub Actions workflows, MCP server, and VS Code extension
- Public site focus: Python AppSec, dead code detection, AI-agent guardrails, and AI-assisted code review
- Total public content pages indexed here: 39