How to use the HTTPS Downgrade Link Auditor agent skill

What the skill makes the agent do

Once installed, the agent checks a website's links and hardcoded URLs for http:// addresses on pages served over HTTPS. It sorts what it finds into internal links, external links, and resource files such as images, scripts and stylesheets.

For each flagged URL it suggests a fix, such as switching to https:// or using a relative path. The skill is a read-and-advise checklist, not a tool that changes your site on its own.

• Internal links using http:// should become https:// or a relative path.
• External links to third-party sites still on HTTP are flagged for review, because the destination may not support HTTPS.
• Resource links (img src, script src, link href) pointing to HTTP are flagged as causing active mixed content warnings.

Install the skill from the ZIP download

Download the ZIP of the https-downgrade skill from this page, then unzip it. The skill folder contains two files: SKILL.md and references/rule.md.

For a personal install, unzip it into ~/.claude/skills/. To limit it to one project, unzip it into that project's .claude/skills/ folder.

Alternatively, upload the skill in the Claude apps under Settings → Capabilities → Skills.

Trigger the skill with natural requests

The skill's description says when to use it: auditing a site's internal and external links for protocol consistency, migrating a site from HTTP to HTTPS, or reviewing hardcoded URLs in a codebase that may use http:// instead of https://. You do not need a special command; describe the task in plain language that matches one of those situations.

• Check this template folder for hardcoded http:// URLs before we move the site to HTTPS.
• Audit the internal and external links on our pages for mixed content problems.
• We are migrating from HTTP to HTTPS. Which links and resources still use http://?

What the audit checks and how fixes are suggested

The skill checks <a href> attributes, along with <img src>, <script src> and <link href>, for values starting with http:// that are not https:// or relative paths. In JavaScript projects it also looks for http:// in fetch(), axios, or router navigation calls. The report counts HTTP links by category: internal, external and resource.

The fix guidance covers changing internal links to relative paths or https://, checking whether external destinations support HTTPS, and using https:// or protocol-relative // for resources. It also mentions running a search-and-replace in your CMS or database, and adding a server-level redirect from HTTP to HTTPS.

• Verification suggestion from the skill: grep -r 'href="http://' ./templates/
• Protocol-relative URLs look like //example.com.
• Do not hardcode http:// for internal links.

Safety notes before you run it

The skill metadata lists no requirements, does not run scripts, and does not use the network. Because it is advice-only, the agent reports findings rather than editing your site.

Review every suggested change before applying it. The skill's own guidance warns that a blanket search-and-replace could break URLs that genuinely need HTTP. The skill also does not cover certificate setup or server configuration.

Tips for a useful audit

Run the audit on the source templates and content, not only on the rendered pages, so you can fix the cause rather than individual links.

Check external HTTP destinations manually, since the skill flags them for review but cannot confirm whether they support HTTPS.

Skip the audit for sites that are still fully HTTP, because the rule only applies to pages served over HTTPS.