Guide · Agent skill
How to use the HTTPS Site Checker agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The https agent skill tells an AI agent how to audit whether a website or web application serves all content exclusively over HTTPS with a valid certificate. It is built from the Front-End Checklist rule "Serve all pages over HTTPS" and is aimed at web developers, site owners and students. After this guide you will know what the skill does, how to install it, how to ask for it in plain language and what to watch for when using it.
HTTPS Site Checkerthedaviddias/Front-End-Checklist · MIT Download the skill Quick start
- 1Download the skill ZIP. Download the ZIP file for the https skill from the skill page.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ in your project.
- 3Or upload it in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Describe your audit. Ask the agent in plain words to check whether a named site is served only over HTTPS with a valid certificate.
- 5Check redirects and certificate. Ask the agent to confirm HTTP requests return a 301 redirect to HTTPS and that the certificate covers all hostnames including www.
- 6Verify independently. Cross-check the certificate chain with SSL Labs at ssllabs.com/ssltest and aim for A or A+.
What is an agent skill and what does the https skill do?
An agent skill is a folder of instructions that an AI agent can load when a task matches the skill's description. The https skill is one of these. Its description says it is used when auditing whether a website or web application serves content exclusively over HTTPS with a valid certificate.
Once loaded, the agent follows a checklist from the rule. It checks that every page is served over HTTPS, that the TLS certificate is valid and not expired, and that it covers all hostnames including www. It also confirms that plain HTTP requests redirect to HTTPS with a 301 (permanent) status code. The agent can also explain why plain HTTP is risky and walk through obtaining a TLS certificate and configuring the web server, for example with Let's Encrypt and Certbot.
- Checks that all pages load over HTTPS
- Checks that the certificate is valid, unexpired and covers all hostnames, including www
- Checks that HTTP redirects to HTTPS with a 301 response
- Explains why HTTPS matters and how certificates are configured
- Reviews server config and related behaviour against the rule
How do you install the https skill?
You can install the skill in one of three places. Download the ZIP file from the skill page and unzip it into a skills folder. For a personal setup, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.
If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal: unzip into ~/.claude/skills/
- Project: unzip into .claude/skills/ inside your project folder
- Claude apps: upload under Settings → Capabilities → Skills
What files are in the skill?
The skill contains two files. SKILL.md holds the skill name, description, metadata and the instructions the agent follows. references/rule.md holds the longer rule page, with background on HTTPS and implementation notes, which the agent can consult for more detail.
- SKILL.md: the main instructions and metadata
- references/rule.md: the full rule text with background and examples
How do you trigger the skill with a natural request?
You do not need a special command. Describe the task in ordinary words that match the skill's purpose, such as asking the agent to audit a site's HTTPS setup. Name the website or project you want checked so the agent knows where to look.
Good requests mention the goal: checking the certificate, checking redirects, or preparing for a launch or security audit.
- "Check whether example.com is served only over HTTPS with a valid certificate."
- "Audit my web app's HTTP to HTTPS redirects and confirm they use a 301."
- "Does my certificate cover both the bare domain and www?"
- "Walk me through getting a free Let's Encrypt certificate for my Nginx server."
What should you check in the results?
Ask the agent to report each check separately: all pages over HTTPS, certificate validity and hostname coverage, and the status code returned for plain HTTP requests. Ask it to show the exact responses it relied on, so you can verify them yourself.
The rule also points to SSL Labs (ssllabs.com/ssltest) for verifying the certificate chain, with a target grade of A or A+. Use that as an independent check alongside the agent's review.
- Confirm every page and internal link uses HTTPS
- Confirm the certificate is not expired and includes www if you use it
- Confirm HTTP returns a 301 redirect to HTTPS
What does the skill need and what are the safety notes?
The skill lists no required dependencies. It does not run scripts, but it does use the network, because the agent needs to reach the site it is auditing. Only ask the agent to check sites you own or have permission to test. The skill itself does not define an authorized testing scope.
The guidance is general. It does not cover a full TLS configuration review, so it is not a substitute for a professional penetration test on high-stakes systems.
- Requires: nothing listed
- Runs scripts: no
- Uses network: yes
- Only test sites you are authorised to test
- Not a replacement for a professional penetration test
Tips for getting better results
Give the agent the exact domain names in use, including whether www is used, so it can check hostname coverage. If you are setting up a new server, ask it to walk through the Certbot steps for your web server, and remember the rule also expects internal links and resources to use HTTPS URLs.
The skill's metadata lists an estimated time of 30 minutes for the rule, so plan a short session rather than expecting an instant result.
- Name every domain and subdomain you want covered
- Ask for the Certbot steps that match your web server
- Ask the agent to check internal links and resources for http:// URLs
What people use it for
- Reviewing a website's HTTP to HTTPS redirects before launch
- Checking that a certificate covers both the bare domain and www
- Preparing a web app for a security audit by reviewing HTTPS setup
- Learning why plain HTTP exposes passwords and session tokens and how Let's Encrypt certificates are configured
Frequently asked questions
How do I install the https agent skill?
Download the ZIP from the skill page and unzip it into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
Is the https skill free?
The skill is published under the MIT licence. The source says the rule uses a free Let's Encrypt certificate as one option, but this page does not state any price for the skill itself.
Does the https skill run scripts or scan sites automatically?
No. The skill does not run scripts. It is a checklist-style guide that tells the agent what to check, and it uses the network only as the agent reaches the site you ask about.
What do I need to use the https skill?
The skill lists no requirements. You need an agent that can load skills and access the site you want checked.
Can the agent replace SSL Labs or a penetration test?
No. The rule recommends SSL Labs for verifying the certificate chain, aiming for an A or A+ grade. The guidance is general and does not cover full TLS configuration review, so high-stakes systems still need a professional penetration test.
Why does the skill check for a 301 redirect?
A 301 is a permanent redirect, which tells browsers and search engines that plain HTTP addresses should move to HTTPS. The rule requires all HTTP traffic to redirect this way.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
The https skill suits web developers, site owners preparing for an audit or launch, and students who want an agent to review HTTPS setup, certificate coverage and 301 redirects. It is not an automated scanner and does not define authorised testing scope, so people who need a formal security assessment of a high-stakes system should choose a professional penetration test instead.
Download the skill