storage-scan

Analyzes how a codebase stores, accesses, versions, and protects persistent data.

3|1|Updated Aug 26, 2026
One-click install
npx skills add https://github.com/zeljkoobrenovic/sokrates-skills --skill storage-scan-zeljkoobrenovic
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: storage-scan
Source: https://github.com/zeljkoobrenovic/sokrates-skills/tree/main/skills/scanners/storage-scan
Command: npx skills add https://github.com/zeljkoobrenovic/sokrates-skills --skill storage-scan-zeljkoobrenovic

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve? Persistent data outlives every process that writes it, yet storage risks like non-atomic writes, unversioned formats, missing migrations, and unbounded accumulation are hard to spot in a large codebase. This Skill reads a project's persistence layer and produces verifiable findings about where data lives, how it is written, and what happens when a writer crashes or formats change. ## Core Features & Use Cases - Data-class inventory: Maps every kind of persistent data (config, state, caches, databases, outputs) with its location, format, owner, writer count, and sensitivity. - Mechanism analysis: Examines access patterns (ORM vs raw SQL, transactions, locking, streaming vs whole-file), schema ownership and migrations, format versioning and compatibility, atomic writes and corruption recovery, and lifecycle (retention, cleanup, backup, export). - Deterministic counting script: Ships a standard-library-only Python script that counts file I/O, serialization, SQL, migration, checksum, and locking sites per ecosystem, excluding test code, to ground findings in facts. - Use Case: Point it at a desktop CLI app with a home directory to learn that session transcripts are append-only JSONL with no version field, that config writes are non-atomic, and which data class is most at risk. ## Quick Start Ask the AI to run the storage scan on this repository and report where the project stores its data and which data class is most at risk.

Frequently Asked Questions about storage-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit where a project stores its data?

Run the storage scan, which builds a data-class inventory mapping each kind of persistent data to its location, format, owner component, writer count, and sensitivity. It then synthesizes a storage posture naming the riskiest data class.

How to check a codebase for non-atomic file writes?

The bundled count_storage_sites.py script counts rename, fsync, temp-file, and in-place write sites per ecosystem, excluding test code. The scanner then reads the writers to determine whether a crash can leave corrupt data and whether a recovery path exists.

Does the storage scan work without a Sokrates analysis?

Yes, it works best with a _sokrates analysis folder but degrades gracefully without one. The counting script and direct source reading still produce evidence-backed findings on any supported language ecosystem.

What languages does the storage scan support?

The counting script covers Rust, Java, Kotlin, Scala, C#, JavaScript, TypeScript, Python, and Go, plus config and SQL files. Patterns include ORM usage, SQL statements, migrations, serialization, checksums, and file locking per ecosystem.

What are the limitations of the storage scan?

It does not audit secrets at rest, encryption, or access control, which belong to the security scan, and it does not measure I/O performance costs, which belong to the performance scan. It references those scanners' findings instead of duplicating them.