Hacktoberfest 2026: where to start

[NovaCode37]

claude-security-skills takes Hacktoberfest pull requests. Merged PRs get the hacktoberfest-accepted label, so they count.

Already merged this month: #67 (one key, one finding), #68 (requests calls without a timeout) and #71 (urllib and httpx timeouts). Thanks!

Just released in 1.3.0: a GitHub Action and SARIF output, so findings land on the pull request diff. Several issues below build on that.

The eight skills are plain Python with no dependencies, each with its own engine and tests, so most issues touch one file and you do not need Claude Code to work on them. Everything open for it carries the hacktoberfest label.

Good first ones: add one detection to one engine

• jwt-inspector: detect jku, x5u and path-like kid header injection #38 jwt-inspector: catch jku, x5u and path-like kid header injection
• sast-lite: detect XXE-prone XML parsing #35 sast-lite: flag XXE-prone XML parsing
• dockerfile-scan: flag a missing HEALTHCHECK and a left-behind package cache #44 dockerfile-scan: missing HEALTHCHECK and a package cache left in the image
• dependency-check: parse go.mod #43 dependency-check: parse go.mod
• prompt-injection-tester: add unicode-obfuscation and multi-turn payloads #40 prompt-injection-tester: unicode obfuscation and multi-turn payloads
• dependency-check: grow the bundled advisory database #39 dependency-check: grow the bundled advisory database
• http-sec-audit and cors-auditor take exactly one URL #54 http-sec-audit and cors-auditor take more than one URL
• docs: record a terminal demo for the README #41 record a terminal demo for the README
• sast-lite: no-timeout rule misses from-imports and sessions opened with 'with' #72 sast-lite: the no-timeout rule for from requests import get and with requests.Session()
• sast-lite: flag tarfile extraction without a filter (TarSlip) #61 sast-lite: tarfile extraction without a filter (TarSlip)
• sast-lite: catch TLS verification disabled through the ssl module #62 sast-lite: TLS checks turned off through the ssl module
• SARIF output for dockerfile-scan #63 SARIF output for dockerfile-scan
• --min-severity for secret-scanner and dockerfile-scan, so the action's input applies to every engine #65 --min-severity for the two engines that lack it

Bigger, if you want something to chew on: #64 dependency-check locations and SARIF, #50 a baseline file for existing repos, #51 scan git history for secrets, #52 a docker-compose.yml checker, #45 a new skill auditing GitHub Actions workflows, #53 reading lockfiles, #70 --exclude for the engines and the action.

How it works here

• Comment on the issue first; I assign within a day.
• One issue per PR, with tests. pytest skills/ -q runs everything offline in under a second.
• No new runtime dependencies; the standard library is the point.
• PRs that only reformat, fix a README typo or add a name to a list get closed as invalid and do not count.