Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Use when reviewing HTML forms, fetch/XHR calls, and form action attributes to ensure data is submitted exclusively over HTTPS.
.claude/skills/thedaviddias-form-https/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | 36% | 0% |
| case-02 | ✗→✓ | ▲ Improved | -8% | 0% |
| case-21 | ✗→✓ | ▲ Improved | 29% | 0% |
| case-03 | ✓→✓ | ＝ Same ✓ | 92% | 0% |
| case-04 | ✓→✓ | ＝ Same ✓ | 8% | 0% |
A login form that posts credentials to an HTTP endpoint sends usernames and passwords as plain text over the network — anyone on the same Wi-Fi, the ISP, or a network proxy can read them without any special tools.
<form action> URL must use https:// — never http://action attribute submit to the current page URL — ensure the page itself is on HTTPSfetch() and XMLHttpRequest calls in JavaScript — data posted to http:// endpoints is unencryptedScan all HTML form elements for action attributes pointing to http:// URLs. Check all JavaScript fetch() and XMLHttpRequest calls for http:// endpoints. Verify the current page URL is HTTPS so forms without an explicit action submit securely.
Replace all http:// form action URLs with https:// equivalents. Ensure the web server redirects HTTP to HTTPS (301) so that forms on the page also benefit. For JavaScript API calls, update all endpoint URLs to use https://.
Explain why form submissions over HTTP expose user data in transit, how network attackers can intercept plain HTTP traffic, and what the browser security indicators look like on insecure forms.
Review server config, headers, forms, and integration points related to Submit forms over HTTPS. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.
For full implementation details, code examples, and framework-specific guidance, see references/rule.md.
Rule page: https://frontendchecklist.io/en/rules/security/form-https
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→pass | 13,410 | 13,020 | -3% | 1 | 1 | 0% | 1,752 | 2,374 | +36% | 0 | 0 | — |
case-02 | fail→pass | 10,839 | 7,192 | -34% | 1 | 1 | 0% | 1,835 | 1,695 | -8% | 0 | 0 | — |
case-03 | pass→pass | 3,536 | 4,110 | +16% | 1 | 1 | 0% | 577 | 1,105 | +92% | 0 | 0 | — |
case-04 | pass→pass | 10,617 | 8,573 | -19% | 1 | 1 | 0% | 1,876 | 2,027 | +8% | 0 | 0 | — |
case-05 | pass→pass | 4,268 | 4,631 | +9% | 1 | 1 | 0% | 648 | 1,228 | +90% | 0 | 0 | — |
case-06 | pass→pass | 11,110 | 8,959 | -19% | 1 | 1 | 0% | 2,115 | 2,173 | +3% | 0 | 0 | — |
case-07 | pass→pass | 10,773 | 9,848 | -9% | 1 | 1 | 0% | 2,010 | 2,168 | +8% | 0 | 0 | — |
case-08 | pass→pass | 8,466 | 6,630 | -22% | 1 | 1 | 0% | 1,535 | 1,595 | +4% | 0 | 0 | — |
case-09 | pass→pass | 7,904 | 7,664 | -3% | 1 | 1 | 0% | 1,530 | 1,725 | +13% | 0 | 0 | — |
case-10 | pass→pass | 9,769 | 5,898 | -40% | 1 | 1 | 0% | 1,656 | 1,536 | -7% | 0 | 0 | — |
case-11 | pass→pass | 6,458 | 3,228 | -50% | 1 | 1 | 0% | 1,030 | 919 | -11% | 0 | 0 | — |
case-12 | pass→pass | 12,132 | 7,080 | -42% | 1 | 1 | 0% | 2,216 | 1,643 | -26% | 0 | 0 | — |
case-13 | pass→pass | 9,921 | 6,890 | -31% | 1 | 1 | 0% | 1,668 | 1,679 | +1% | 0 | 0 | — |
case-14 | pass→pass | 11,010 | 6,688 | -39% | 1 | 1 | 0% | 1,987 | 1,590 | -20% | 0 | 0 | — |
case-15 | pass→pass | 3,475 | 4,252 | +22% | 1 | 1 | 0% | 653 | 1,208 | +85% | 0 | 0 | — |
case-16 | pass→pass | 11,015 | 9,662 | -12% | 1 | 1 | 0% | 1,816 | 2,062 | +14% | 0 | 0 | — |
case-17 | pass→pass | 8,430 | 7,078 | -16% | 1 | 1 | 0% | 1,496 | 1,668 | +11% | 0 | 0 | — |
case-18 | fail→fail | 6,232 | 4,846 | -22% | 1 | 1 | 0% | 1,159 | 1,266 | +9% | 0 | 0 | — |
case-19 | pass→pass | 8,096 | 6,881 | -15% | 1 | 1 | 0% | 1,534 | 1,631 | +6% | 0 | 0 | — |
case-20 | pass→pass | 8,760 | 3,932 | -55% | 1 | 1 | 0% | 1,424 | 1,080 | -24% | 0 | 0 | — |
case-21 | fail→pass | 7,175 | 6,496 | -9% | 1 | 1 | 0% | 1,192 | 1,532 | +29% | 0 | 0 | — |
case-22 | pass→pass | 10,814 | 7,475 | -31% | 1 | 1 | 0% | 972 | 1,283 | +32% | 0 | 0 | — |
case-23 | pass→pass | 10,140 | 6,845 | -32% | 1 | 1 | 0% | 1,756 | 1,597 | -9% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +13 percentage points is the difference between those two pass rates over the 23 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.