What are the major flaws and limitations of this hash-based stream cipher design?
Are there any fundamental flaws?


The construction itself is secure for a good H. It's close to what many stream ciphers use internally. E.g. chacha has an H that hashes a 256-bit key, a 64-bit nonce and a 64-bit counter to get 512 bits of output.


  Would it make sense to use a longer key?


Yes, if you want more brute force resistance, since finding a preimage is not enough to find the key, if it leads to different values for other counter values.


  Under what circumstances would doing H(C + K + C) instead of H(K + C) make the algorithm more secure?


If your H was vulnerable to length extension attack (e.g. SHA-256) and the counter was variable length, H(K + C) would not be secure, but H(C + K + C) might. However, with a constant sized C, I can't think of a reason to use H(C + K + C).


  I intend to use Skein, [...]


Then shouldn't you use the stream cipher construction from the Skein paper (pdf, section 4.10)?