Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Use when reviewing HTTP response headers on any site that serves content over HTTPS.
.claude/skills/thedaviddias-hsts/SKILL.md| Model | Eval pass | Runs |
|---|---|---|
| gemini-3.6-flash | 100% | 54 |
| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | 3% | 0% |
| case-13 | ✗→✓ | ▲ Improved | -18% | 0% |
| case-02 | ✓→✓ | ＝ Same ✓ | -3% | 0% |
| case-08 | ✓→✓ | ＝ Same ✓ | 12% | 0% |
| case-03 | ✓→✓ | ＝ Same ✓ | -7% | 0% |
Without HSTS, an attacker on the same network can intercept the first HTTP request and strip TLS (SSL stripping), silently downgrading the connection before the browser ever sees a redirect.
Strict-Transport-Security: max-age=31536000; includeSubDomains on all HTTPS responsesmax-age=31536000 (1 year) minimum; HSTS preloading requires at least 1 yearincludeSubDomains to protect all subdomains from downgrade attackspreload only after testing — it is difficult to reverse and takes weeks to propagateCheck whether the server sends a Strict-Transport-Security header on all HTTPS responses, and verify the max-age, includeSubDomains, and preload directives are appropriate.
Add a Strict-Transport-Security header with max-age=31536000 and includeSubDomains to all HTTPS responses. Configure your web server or CDN to send this header, and validate it with curl or securityheaders.com.
Explain what HTTP Strict Transport Security (HSTS) is, how it prevents SSL stripping attacks, what the max-age and includeSubDomains directives do, and why the preload directive requires caution.
Review server config, headers, forms, and integration points related to Set an HSTS header. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.
For full implementation details, code examples, and framework-specific guidance, see references/rule.md.
Rule page: https://frontendchecklist.io/en/rules/security/hsts
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→pass | 6,487 | 5,740 | -12% | 1 | 1 | 0% | 1,478 | 1,515 | +3% | 0 | 0 | — |
case-02 | pass→pass | 9,266 | 7,289 | -21% | 1 | 1 | 0% | 2,077 | 2,014 | -3% | 0 | 0 | — |
case-08 | pass→pass | 8,917 | 8,043 | -10% | 1 | 1 | 0% | 1,863 | 2,094 | +12% | 0 | 0 | — |
case-03 | pass→pass | 8,769 | 6,566 | -25% | 1 | 1 | 0% | 1,821 | 1,699 | -7% | 0 | 0 | — |
case-04 | pass→pass | 10,685 | 9,067 | -15% | 1 | 1 | 0% | 2,090 | 2,199 | +5% | 0 | 0 | — |
case-05 | pass→pass | 10,279 | 8,323 | -19% | 1 | 1 | 0% | 2,202 | 2,243 | +2% | 0 | 0 | — |
case-06 | pass→pass | 12,478 | 12,009 | -4% | 1 | 1 | 0% | 2,386 | 2,612 | +9% | 0 | 0 | — |
case-07 | pass→pass | 10,840 | 6,761 | -38% | 1 | 1 | 0% | 2,344 | 1,971 | -16% | 0 | 0 | — |
case-09 | pass→pass | 8,209 | 7,539 | -8% | 1 | 1 | 0% | 1,788 | 2,016 | +13% | 0 | 0 | — |
case-10 | pass→pass | 7,679 | 6,574 | -14% | 1 | 1 | 0% | 1,479 | 1,824 | +23% | 0 | 0 | — |
case-11 | pass→pass | 3,307 | 3,307 | 0% | 1 | 1 | 0% | 594 | 1,050 | +77% | 0 | 0 | — |
case-12 | pass→pass | 5,135 | 4,703 | -8% | 1 | 1 | 0% | 1,118 | 1,424 | +27% | 0 | 0 | — |
case-13 | fail→pass | 13,571 | 6,932 | -49% | 1 | 1 | 0% | 2,232 | 1,827 | -18% | 0 | 0 | — |
case-14 | pass→pass | 6,604 | 4,629 | -30% | 1 | 1 | 0% | 1,347 | 1,436 | +7% | 0 | 0 | — |
case-15 | pass→pass | 8,890 | 4,719 | -47% | 1 | 1 | 0% | 1,739 | 1,491 | -14% | 0 | 0 | — |
case-16 | pass→pass | 10,105 | 7,857 | -22% | 1 | 1 | 0% | 1,879 | 1,974 | +5% | 0 | 0 | — |
case-17 | pass→pass | 8,616 | 4,869 | -43% | 1 | 1 | 0% | 1,506 | 1,163 | -23% | 0 | 0 | — |
case-18 | pass→pass | 9,992 | 6,772 | -32% | 1 | 1 | 0% | 2,082 | 1,801 | -13% | 0 | 0 | — |
case-19 | pass→pass | 10,692 | 11,362 | +6% | 1 | 1 | 0% | 2,166 | 2,422 | +12% | 0 | 0 | — |
case-20 | pass→pass | 7,543 | 5,790 | -23% | 1 | 1 | 0% | 1,511 | 1,661 | +10% | 0 | 0 | — |
case-21 | pass→pass | 5,135 | 5,083 | -1% | 1 | 1 | 0% | 1,127 | 1,514 | +34% | 0 | 0 | — |
case-22 | pass→pass | 3,833 | 3,106 | -19% | 1 | 1 | 0% | 868 | 1,217 | +40% | 0 | 0 | — |
case-23 | pass→pass | 5,752 | 5,112 | -11% | 1 | 1 | 0% | 1,235 | 1,499 | +21% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +9 percentage points is the difference between those two pass rates over the 23 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.