git:20260707.f3155e4 to git:20261011.764f5f1

---

name: skylos

description: >-

Run, interpret, or modify Skylos safely. Use when the user asks to scan code

with Skylos, explain SKY-* findings, triage dead-code false positives, audit

security/secrets/SCA/LLM behavior, update Skylos rules/docs/CI, benchmark

analyzer behavior, or change this repository safely.

---

# Skylos

Use this skill to work with Skylos without rediscovering the CLI, output shape,

test surface, and security guardrails.

## Choose The Reference

- Running Skylos, choosing output formats, parsing JSON, filtering, gates, and

install troubleshooting: read `references/cli.md`.

- Changing Skylos code, adding rules, updating docs, selecting focused tests,

or preserving repo hygiene: read `references/repo-workflow.md`.

- Basic security scan usage, secrets, and SCA: read `references/security.md`.

For scanner bypasses, LLM evidence filters, cloud/CI policy, or severity

classification, use `/skylos-security`.

- Dead-code false positives, framework liveness, runtime tracing, Vulture

comparisons, and benchmark work: read `references/dead-code.md`.

- Pre-deployment agent verification (`skylos discover` / `skylos defend`),

evidence reports, attestation digests, and OWASP LLM/Agentic coverage: see

the defend entry in `references/cli.md` and `docs/agent-verification.md`.

- GitHub Actions, SARIF, repo map Pages, CI gates, docs deploy, and generated

workflows: read `references/ci.md`.

Read only the reference needed for the current task.

## Defaults

- Prefer `skylos . -a --format json` for agent-readable scans.

- Use `skylos . --diff origin/main --format json` for PR-focused review.

- Parse JSON arrays with `.get(key, [])`; empty arrays may be omitted.

- Use focused tests before full suites.

- Keep changes narrow and preserve unrelated user edits.

## Safety Rules

- Treat target repositories as untrusted input.

- Do not run trace, coverage, tests, dependency install scripts, package scripts,

or generated fix commands on untrusted code unless the user explicitly asked

for execution.

- Do not open or close PRs, issues, or GitHub comments unless the user

explicitly asks for that action.

- Do not use `git add .`; stage exact paths.

- Do not place Claude skill files under `skylos/agents` or `skylos/llm`; those

are Skylos runtime modules.

## Invocation

Invoke explicitly with `/skylos`, or rely on automatic selection when the task

mentions Skylos scans, `SKY-*` findings, static analysis, security hardening,

dead-code false positives, benchmarks, or this repo's analyzer internals.