skales - Moses Yebei

skales

Abstract

Personal AI desktop agent for Windows, macOS, Linux, Android & iOS. Set a goal, it works on its own. Teams (pair two desktops, agents + humans), Agent2Agent, Workflows, Codework, multi-agent orgs, desktop + browser automation. 15+ AI providers, BYOK. No Docker, no terminal. Agent Skills (SKILL.md). Migration importer. Recurring autonomous tasks.

The Problem

Skales is a closed-source personal AI desktop agent. This repository is not the product's source: the README states plainly that the checked-in tree is a historical v7 snapshot that is "not maintained, not built and not what runs on your machine." Anyone cloning this expecting to build or extend the current agent will be working against a stale artifact.

What This Does

The repo is the distribution surface for Skales: install guides (INSTALL-WINDOWS.md, INSTALL-MAC.md, INSTALL-LINUX.md), changelog, BSL 1.1 license, and the issue tracker. The code that exists is a Next.js web app (apps/web) wrapped by an Electron shell (electron/main.js), with 30+ action modules under apps/web/src/actions/ covering chat, tasks, calendar, email, browser control, and roughly 90 API routes under apps/web/src/app/api/.

How It Is Wired

Execution starts at electron/main.js, which hosts the Next.js app. The wiring hub is apps/web/src/actions/: chat.ts is the most-imported module (7 importers, 0 outgoing edges), and orchestrator.ts imports the most (6 modules), making it the coordination point. API routes expose these actions over HTTP — autopilot, calendar, custom-skills, code, email, ftp, and more. The import graph is clean: 190 modules, 0 circular dependencies, so no cycle-breaking cost exists today. Blast radius concentrates in chat.ts (752 lines, 245 branch points, nesting depth 7) — a change there ripples through 7 importers. The Electron-to-web bridge beyond main.js has not been mapped by this analysis.

How To Use It

The README is explicit: do not build this snapshot. For the product, download the signed app from skales.app. The files imply an npm workflow (package.json, next.config.mjs, apps/web/package.json), so a local run would be npm install then npm run dev inside apps/web — but the README disclaimer means there is no evidence this snapshot builds or runs as-is. Missing: no CI, no Dockerfile, no documented build command for this tree.

Real-World Use

The product scenario: hand it a goal (e.g., "build me a trading bot"), it works autonomously across steps, reaches you via WhatsApp or Telegram. For this repo specifically, the realistic use is a security or architecture audit of the v7 snapshot, or a reference for the action-module pattern.

Code Health & Issues

Static analysis found 108 issues (46 high, 62 medium):

High — deep nesting (51 instances): chat.ts, tasks.ts, Sidebar.tsx hit indentation depth 7.
High — oversized files (7): chat.ts and orchestrator.ts exceed 700 lines.
High — duplicated code blocks: 53 repeated 6-line blocks across 36 files, including discord-bot.js, telegram-bot.js, autopilot.ts.
Medium — high branching density: 245 branches over 752 lines in chat.ts.

SDLC observations: no CI pipeline; committed secrets flagged (apps/web/src/actions/secrets.ts); test ratio 0.026 (5 test files vs 191 source files); postinstall lifecycle script in package.json; dependencies far behind — electron ^28 vs current 43, next 14 vs 16.

The Bottom Line

A stale, unmaintained snapshot of a closed-source product, not a codebase to build on. The measured analysis confirms the quality decay a dead snapshot accumulates, and the README's own disclaimer makes building from it a dead end. Use it to audit the v7 architecture or study the action-module pattern; for actual use, download the signed product.

What the analyser found

Deployment readiness

4/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

333 files

TypeScript138
TSX37
JSON17
JavaScript15
Markdown13
HTML6

ReactNext.jsTailwind

Module dependencies

The 10 most depended-upon modules of 190, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_apps_web_src_actions_chat["chat"] n1_eb_src_lib_calendar_provider["calendar-provider"] n2_apps_web_src_lib_paths["paths"] n3_s_web_src_lib_memory_scanner["memory-scanner"] n4_web_src_lib_calendar_outlook["calendar-outlook"] n5_apps_web_src_actions_tasks["tasks"] n6_s_web_src_lib_calendar_apple["calendar-apple"] n7__web_src_lib_calendar_google["calendar-google"] n8_web_src_lib_memory_retrieval["memory-retrieval"] n9_web_src_actions_capabilities["capabilities"] n5_apps_web_src_actions_tasks --> n0_apps_web_src_actions_chat n6_s_web_src_lib_calendar_apple --> n1_eb_src_lib_calendar_provider n7__web_src_lib_calendar_google --> n1_eb_src_lib_calendar_provider n4_web_src_lib_calendar_outlook --> n1_eb_src_lib_calendar_provider n4_web_src_lib_calendar_outlook --> n2_apps_web_src_lib_paths n8_web_src_lib_memory_retrieval --> n3_s_web_src_lib_memory_scanner

Dependencies

22 of 46 declared dependencies are a major version behind. Resolved 46 of 46 against the registry.

Package	Declared	Latest	Behind
`electron`	^28.0.0	43.4.0	15 major
`@types/node`	^20	26.2.0	6 major
`archiver`	^5.3.2	8.0.0	3 major
`nodemailer`	^6.9.14	9.0.5	3 major
`electron-store`	^8.1.0	11.0.2	3 major
`framer-motion`	^11.0.8	13.1.0	2 major
`next`	14.1.0	16.3.1	2 major
`node-telegram-bot-api`	^0.66.0	2.1.0	2 major

Findings

MediumNo CI/CD pipeline detected - no automated build/test gate .github/ or CI config
LowSecret-shaped paths present; the code-health audit confirms or clears them apps/web/src/actions/secrets.ts

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

critical1

high1

medium3

low1

Upgrade the pinned dependency carrying a critical advisorycritical32 occurrences

next@14.1.0 CVE-2025-29927 (critical) +31 more

The manifest pins the exact version the advisory covers, so this is not a warning about drift: the vulnerable code is what installs, and a critical rating means it is reachable over the network without credentials or user interaction.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Add a workflow that builds and tests this repositoryhigh

192 source files, no CI configuration

Every change merges with nobody having run the build once, which across this estate is 499 repositories.

Fix: Add a workflow running the project build and test command on push and pull_request.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Review the install lifecycle script and disable scripts in CImedium

package.json

postinstall

Install scripts are the execution vector for every npm compromise from event-stream onward, and a postinstall that fetches a binary makes the build depend on a URL nobody reviews.

Fix: Move the work into an explicit build step, or set ignore-scripts in CI and run it by name.

Expand the test suite; it cannot cover this codebasemedium5 occurrences

5 test files against 191 source files (ratio 0.026)

A reviewer reads "has tests" and assumes a safety net that covers two files out of eighty-five, which is how untested paths ship behind a green badge.

Fix: Add tests for the highest fan-in modules first.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.