Conciseness

The ~46-line body is lean and sectioned with no padding explaining concepts Claude already knows, but Quick Reference contains two bullets both stating that 'upgrade-insecure-requests' is the practical fix, and the opening line duplicates the 'Why It Matters' framing from the reference. These are minor instances of over-explanation that could be trimmed, matching anchor 4 rather than the fully lean anchor 5.

Actionability

The Check and Fix sections give concrete, specific instructions — exact attributes to scan ('Check <script src>, <img src>, <link href>, <iframe src>, and CSS url() values for http:// URLs') and the exact remediation ('Replace all http:// resource URLs with https:// equivalents', 'Add Content-Security-Policy: upgrade-insecure-requests'). No executable command appears inline in SKILL.md itself (the grep and config snippets live in references/rule.md), leaving minor gaps that fit anchor 4.

Workflow Clarity

The Check → Fix → Explain → Code Review sections form a clear, coherent sequence, and a verification checkpoint is present ('verify them against the effective production-like response'). However, verification is a single implicit step with no explicit validate→fix→retry feedback loop, matching 'clear sequence with most checkpoints present; minor validation gaps' rather than anchor 5.

Progressive Disclosure

The body is a concise, well-sectioned overview with one clearly signaled, one-level-deep reference — 'For full implementation details, code examples, and framework-specific guidance, see references/rule.md' — and that file exists and delivers exactly what the pointer promises (code examples, CSP configs for Nginx/Next.js, detection tooling) with no nested references. This matches 'clear overview with well-signaled one-level-deep references; easy navigation'.

Specificity

The description names the domain and one concrete action — 'reviewing an HTTPS page for resources (scripts, images, stylesheets, iframes) that are loaded over plain HTTP' — but covers only detection, not the fix/remediation capabilities the skill provides. It matches 'names domain and 1-2 concrete actions, but not comprehensive' rather than 'several specific actions'.

Completeness

An explicit 'Use when...' trigger clause is present, and the 'what' (reviewing HTTPS pages for HTTP-loaded sub-resources) is conveyed by the gerund phrase within it. Both what and when are answerable, but the 'what' is embedded rather than independently stated and omits the remediation half of the skill, matching 'both present; could be more explicit'.

Trigger Term Quality

Good natural keyword coverage ('HTTPS page', 'scripts, images, stylesheets, iframes', 'plain HTTP', 'reviewing'), but the canonical phrase users would say — 'mixed content' — is entirely absent. Fits 'good keyword coverage; a few natural terms missing' rather than comprehensive synonym coverage.

Distinctiveness Conflict Risk

The trigger describes a narrow, well-defined scenario (HTTP sub-resources on an HTTPS page) with distinct terms that few other skills would claim, giving minimal conflict risk. Fits 'clear niche with distinct triggers; minimal conflict risk'.