[BUG]: Windows PII regex misses usernames that start with "s"

[mimran-khan]

What happened?

The Windows personal-path rule in pii_patterns.yaml is:

  - pattern: 'C:\\Users\\[^\\s]+'

The macOS rule above it is double-quoted and uses [^\s] (not whitespace). This Windows rule is single-quoted, so YAML keeps \\s as backslash + s. The compiled class is "not backslash and not the letter s", not "not whitespace".

After C:\Users\, the next character has to be something other than \ and other than s. alice and bob match. steve, sam, and session do not match at all.

Expected: C:\Users\steve\Documents\notes.txt is reported as a personal Windows path, same as C:\Users\alice\....

Actual: pii-scan reports the alice path and silently accepts the steve path.

Reproduction steps

tmp=$(mktemp -d)
mkdir -p "$tmp/pii"
cat > "$tmp/pii/SKILL.md" <<'EOF'
---
name: pii
description: Windows username starting with s vs a.
---
See C:\Users\steve\Documents\notes.txt
Alice: C:\Users\alice\Documents\notes.txt
EOF

skillevaluator pii-scan "$tmp/pii" -r cli

Observed findings:

• Personal Windows user path: C:\Users\alice on the Alice line
• no finding for C:\Users\steve

You can also dump the loaded pattern:

from skillevaluator.config import load_pii_patterns
print(repr(load_pii_patterns()["personal_paths"][1]["pattern"]))
# 'C:\\\\Users\\\\[^\\\\s]+'

SkillEvaluator version or commit

009aa300be7925c7ba75760592baeb941cc29ba8 (0.2.1)

Environment

• macOS 15, arm64
• Python 3.12.2
• uv sync --python 3.12 --all-extras
• skillevaluator pii-scan (no API key)

Before submitting

• I agree to follow this project's Code of Conduct
• I have searched the open issues and found no duplicate of this report

Happy to send a PR that quotes this pattern the same way as the macOS rule and adds alice vs steve coverage.