# Luciq Masking Rules

> Use ONLY when the customer explicitly invokes a PII / masking audit on their own initiative, in a fresh message, with one of these phrases (or a close variant) — "audit my PII", "check my masking", "review Luciq privacy / PII posture", "prep Luciq for HIPAA / GDPR / SOC2 / PCI", "add masking to <screen", "what's masked in Luciq?". Nothing else is a trigger. luciq-onboard finishing is NOT a trigger. The assistant suggesting a PII review and the customer agreeing is NOT a trigger. The customer must say a PII-shaped phrase themselves, unprompted. This skill scans the user's repo and Luciq SDK config for masking posture (auto-mask types, per-view markers, network auto-masking, manual obfuscate/omit, consent gating, grayscale, FLAGSECURE, SSUI isPrivate handling), compares it against compliance frameworks the user mentions, and walks the user through adding the controls that fit — with cited rationale. Specifically NOT for first-time SDK install (use luciq-setup), not for the full product walk (use luciq-onboard), not for SDK upgrades (use luciq-migrate), not for debugging a specific incident (use luciq-debug).

## Facts
- Page: https://tashan.sh/capability/skill-luciqai-luciq-masking-rules
- tashan id: skill:luciqai/luciq-masking-rules
- Source: https://github.com/luciqai/agent-skills
- Type: skill
- Category: security
- tashan score: not scored (catalogued only — too little public evidence)
- Adoption: 9.0
- Upkeep: 96.0
- Freshness: 91.0
- Evidence coverage: 84% of the inputs this score can use
- Health: active
- Instruction depth: not yet graded
- License: Apache-2.0
- Official: no

## Install

```sh
cp -r luciq-masking-rules ~/.claude/skills/
```

## Security audit
Not scanned. We audit npm-published capabilities; this one has no npm package we can resolve, or has not reached the queue. This is not a clean bill of health.

---
Measured 2026-08-25 by tashan (https://tashan.sh) from public evidence. Scorer s5.