Practical Python workflows for AI code review, CI hardening, and dead-code cleanup
Use these guides when the problem is concrete: secure GitHub Actions, catch AI-generated mistakes, or clean dead code without drowning in false positives.
Start with one workflow you already run
Pick the guide that matches the job in front of you, run Skylos locally, and only wire it into CI after you trust the results.
pip install skylosskylos . -a on a real reposkylos cicd init when you are ready to gate PRsClaude Code Stop Hook: Block "Done" Until Tests Pass (and Catch Deleted Tests)
A Claude Code Stop hook runs when Claude tries to finish; print decision block and a reason to send it back. A tested script, and why it misses deleted tests.
Claude Code Hooks Examples for Security (Codex and Cursor Too)
Copy-paste Claude Code hooks with real output: PreToolUse hooks that block fake package installs and secret reads, a PostToolUse edit check and a Stop hook.
Django Dead Code: Find Unused Views, Helpers and Methods
Find unused Django views: what Vulture, deadcode, Ruff, django-deadcode and Skylos found on one Django 5.2 app, and configs that fix false positives.
AI Agent Says the Tests Pass? How to Verify AI-Generated Code Before Merge
Run skylos done --base main: it re-runs the tests and fails if the agent deleted, skipped, emptied or special-cased tests, or loosened test settings or CI.
GitHub Actions Security Scanner for CI/CD Supply Chain Risk
Catch risky GitHub Actions workflows before merge: privileged triggers, broad token permissions, unpinned actions, exposed secrets and install scripts.
How to Secure GitHub Actions for Python Repos
Secure GitHub Actions for Python: pin third-party actions, lock down GITHUB_TOKEN permissions, use OIDC, and scan every pull request.
How to Secure an MCP Server Before You Trust It With Your Code
MCP lets AI coding agents read, call and act on your systems. Harden MCP servers before they touch your repo, shell or secrets with this checklist.
Claude Code Security Review: /security-review, Hooks and a PR Check That Blocks
/security-review and Claude Code Review are AI reviewers that don't block merges. Add .claude/settings.json hooks for each edit and a required PR check.
Cursor Security Scanner for Python: Hooks That Check Every Agent Edit
Scan Cursor agent edits as they happen with Cursor hooks: skylos agent install-hooks --cursor writes .cursor/hooks.json for reads, installs, edits and stop.
How to Catch Removed Auth Checks and Security Regressions in AI-Generated PRs
skylos . --diff-base origin/main --danger --quality reports a deleted @login_required, CSRF or rate-limit check as SKY-L021. Which modes miss it, and a CI job.
How to Scan LLM Applications for Prompt Injection, Data Leaks, and Missing Guardrails
Scan LLM application code for prompt injection paths, unsafe output handling and missing guardrails, and see which risks still need testing.
GitHub Copilot Code Review and Security: Gate Copilot Agent PRs in Python
Copilot's review comments, its approvals and its agent's CodeQL checks don't stop a removed auth check or a deleted test. Add a required status check that does.
Detect Hallucinated Packages in AI-Generated Code (Python and npm)
skylos . --select SKY-D222,SKY-D223 --strict checks Python imports against PyPI and package.json against npm, and fails on made-up or undeclared packages.
How to Find Dead Code in Python (Unused Functions, Imports, Classes)
Run a whole-project scanner such as Vulture, deadcode or Skylos (skylos .), check code your framework calls before deleting, then fail CI on new dead code.
Python Security Scanner for GitHub Actions: Scan Every Pull Request
Add a Python security scanner to GitHub Actions and scan every pull request for secrets, injection, dead code and AI-generated code problems.
Turn the guide into a real scan
The guide is useful only if it maps to a repo you already own. Start with a local scan, then decide whether this workflow belongs in CI.