feat(skills): add privacy-pii-detector skill with industry-specific PII detection and control verification

[Yogi (yogitasrivastava)]

Summary

Adds a new privacy-pii-detector skill that automatically detects PII/PI in codebases, classifies by sensitivity tier, verifies privacy controls exist, and raises findings when protections are missing. Requires zero privacy expertise from the user.

Problem this solves

Developers without privacy training have no way to know:

1. What personal data their code actually processes
2. Whether appropriate controls exist for that data
3. What industry-specific PII their domain requires protecting

This skill fills that gap by making the Privacy Reviewer agent capable of automatic detection rather than requiring human-initiated assessment.

What this delivers (8 files, 1,074 lines)

File	Purpose
\SKILL.md\	Entrypoint with goal, success criteria, stop rules, 4-phase protocol
\
eferences/00-pii-taxonomy.md\	47+ PII types across 3 sensitivity tiers with regulatory anchors
\
eferences/01-detection-patterns.md\	Naming conventions, format regex, schema patterns, SDK indicators, log detection
\
eferences/02-control-expectations.md\	Required controls per tier with code-level verification methods
\
eferences/03-finding-schema.md\	YAML structured output for detections, findings, and backlog handoff
\
eferences/10-industry-telco.md\	Telco overlay: IMEI, IMSI, MSISDN, CDR, cell tower, ePrivacy controls
\
eferences/11-industry-healthcare.md\	Healthcare overlay: MRN, diagnoses, genetic data, FHIR mapping, HIPAA controls
\
eferences/12-industry-financial.md\	Financial overlay: PAN, CVV, KYC, credit scores, PCI DSS controls

Architecture: Core + Industry Overlays

\
privacy-pii-detector/
├── SKILL.md # Entrypoint + protocol
├── references/
│ ├── 00-pii-taxonomy.md # Universal PII (all industries)
│ ├── 01-detection-patterns.md # How to find PII in code
│ ├── 02-control-expectations.md # What controls must exist
│ ├── 03-finding-schema.md # Output format
│ ├── 10-industry-telco.md # Telco-specific PII + controls
│ ├── 11-industry-healthcare.md # Healthcare-specific PII + controls
│ └── 12-industry-financial.md # Financial-specific PII + controls
\\

Extensible: New industries added as \1N-industry-.md\ without modifying existing files.

How it differs from existing privacy skills

\privacy-standards\	\privacy-by-design\	\privacy-pii-detector\ (NEW)
Standards backbone	Principle assessment	Automatic detection
User must know what to assess	User invokes assessment	Zero expertise needed
Data-flow reasoning	Conceptual principles	Code-level scanning
No detection capability	Implementation patterns (passive)	Active pattern matching
Single regulatory mapping	Cross-jurisdictional	Industry-specific PII types

Checklist

• Follows hve-builder outcome-first standards (Goal, Success criteria, Stop rules)
• Skill layout matches secure-by-design and owasp-* patterns
• Licensing posture compliant (paraphrased with attribution)
• Industry overlays are self-contained and extensible
• Finding schema compatible with hve-core backlog handoff workflow
• Integrates with privacy-by-design and privacy-standards skills

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.92%. Comparing base (db1be8f) to head (b0d465d).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2636      +/-   ##
==========================================
+ Coverage   82.85%   82.92%   +0.06%     
==========================================
  Files         166      152      -14     
  Lines       22521    22146     -375     
  Branches       29        0      -29     
==========================================
- Hits        18660    18364     -296     
+ Misses       3858     3782      -76     
+ Partials        3        0       -3     

Flag	Coverage Δ
docusaurus	?
pester	86.24% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 16 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.