How to use the HTTPS Form Submission Checker agent skill

What the form-https skill makes the agent do

The skill covers one rule from the Front-End Checklist: submit forms over HTTPS. When you ask for a review, the agent scans HTML form elements for action attributes that point to http:// URLs, checks JavaScript fetch() and XMLHttpRequest calls for http:// endpoints, and verifies that the current page is served over HTTPS so that forms without an explicit action also submit securely.

The skill also explains the reason in plain terms. A login form that posts credentials to an HTTP endpoint sends usernames and passwords as plain text, so anyone on the same Wi-Fi, the ISP, or a network proxy can read them. When the agent finds a problem, it suggests fixes such as switching the endpoint to https:// and having the web server redirect HTTP to HTTPS with a 301.

• Checks form action attributes for http:// URLs
• Checks fetch() and XMLHttpRequest calls for http:// endpoints
• Verifies the page itself is on HTTPS
• Explains why plain HTTP exposes data and suggests fixes

How do you install the form-https skill?

Download the ZIP for the skill from this page and unzip it. You can install it in one of two places. For a personal setup that applies to all your projects, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.

If you use the Claude apps instead of a local setup, open Settings, go to Capabilities, and upload the skill under Skills.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills, then upload

What files does the skill contain?

The skill folder contains two files. SKILL.md holds the rule name, description, a quick reference, and the check, fix, and explain steps the agent follows. references/rule.md holds the longer write-up, including a code example of a login POST sent over plain HTTP and further implementation details. The agent reads SKILL.md first and can consult the reference file for more depth.

• SKILL.md: the main instructions and quick reference
• references/rule.md: full rule details and examples

How do you trigger the skill with a natural request?

You do not need special syntax. The skill is written to activate when you ask the agent to review HTML forms, fetch or XHR calls, or form action attributes for secure submission. Describe what you want checked in ordinary words and point the agent at the relevant files or pages.

• Review the signup form in src/pages/signup.html and confirm it only submits over HTTPS.
• Check all fetch and XMLHttpRequest calls in this project for http:// endpoints.
• Before release, do a security pass on the checkout form and tell me what posts over plain HTTP.
• Explain why our login form would leak passwords if it posted to an http:// URL.

What should you expect in the output?

A good review lists each form or request it checked, says whether it uses https://, and gives the exact location of any http:// URL. For each problem, the agent should suggest a concrete change, such as updating the action attribute or the fetch URL, and remind you to configure the server to redirect HTTP to HTTPS. Read the findings yourself before changing code, since the agent works from the files it can see and cannot test your live server from this skill alone.

The skill also notes that browsers show a 'Not Secure' warning in the address bar when a form is on an HTTP page, and that from Chrome 86 onward autofill is disabled on HTTP forms. These are useful points to mention to a non-technical stakeholder.

What does the skill need, and is it safe to run?

The skill lists no requirements. It does not run scripts and does not use the network, so it works by reading and reviewing the files you give it. Because it only reviews code, it cannot prove that your production server is correctly configured for HTTPS. Confirm redirects and certificates on the live site with your own tools.

The skill's scope is narrow. It covers only the form submission rule, so it is not a full network security audit or a server-side review beyond form submission. It is also aimed at browser forms and web requests, so it does not fit native mobile or desktop apps that do not use HTML forms.

• Requires: nothing listed
• Runs scripts: no
• Uses network: no
• Not a full server security audit

Tips for getting better results

Point the agent at specific files, such as your login, signup, and checkout templates, and at the JavaScript that calls your API. Ask it to include the reference file if you want the full explanation. If you are learning, ask it to explain each finding in plain language so you understand why HTTP is risky, not just what to change.

• Name the exact forms and scripts to review
• Ask for the reasoning behind each finding
• Check the live site's HTTP to HTTPS redirect separately