The body is largely practical (Quick Reference, directive table, server configs, common mistakes), but the 'Why It Matters' and 'How HSTS Works' sections re-explain SSL stripping that the intro already covers and that Claude already knows, so it could be tightened.

It provides fully executable, copy-paste-ready code for Nginx, Apache, Next.js, and Express, a concrete header value, a directives table, and curl/scanner verification commands.

As a simple single-purpose skill the Check/Fix/Explain/Code Review structure plus a dedicated Verification section (automated and manual checks) gives an unambiguous sequence with an explicit validation checkpoint.

The body is a concise overview with a single clearly signaled one-level-deep reference ('see references/rule.md'), which exists as a real file, with detail appropriately split out.

The description names the domain ('HTTP response headers') and one action ('reviewing'), but lists only a single vague action rather than multiple concrete capabilities, matching the level-2 anchor rather than the multi-action level-3 anchor.

It includes an explicit 'Use when...' trigger (the when), but the what ('reviewing HTTP response headers') is vague and never names HSTS or what the skill does, leaving the what only implied rather than clearly answered.

It surfaces natural terms ('reviewing HTTP response headers', 'HTTPS'), but omits common variations a user would actually say such as 'HSTS', 'Strict-Transport-Security', 'security headers', or 'TLS', so coverage is partial.

Tied to a real niche (HTTPS header review), but because it never mentions HSTS it is broader than its single-rule purpose and could overlap with other security-header skills.