Heavybit Skills collection
Your first security program, and the SOC 2 your buyers ask for.
Skills for deciding what to secure first, building a compliance program enterprise customers accept, preparing for a breach before it happens, and securing your cloud infrastructure and your software supply chain. Built from what operators at HashiCorp, Snyk, Splunk, HackerOne, and Chainguard shared in the Heavybit Library.
Six skills
- 01Security Program Foundations
- 02Security Compliance Program
- 03Security Incident Response
- 04Cloud Infrastructure Security
- 05DevSecOps Practices
- 06Software Supply Chain Security
Built from thirty-four library resources
What a skill is
A skill is a set of working instructions your agent loads when you need it, built from the strategies operators shared in the Heavybit Library. It guides the work and you still do it. Heavybit reads and approves every skill before it ships, and keeps updating skills as new content enters the Library. Skills are plain text, so you or your agent can read any skill in full before acting on it. Your agent decides how to apply a skill, so check its work; if a skill gets something wrong, ask your agent to report it or email platform@heavybit.com.
Connect your agent
- Add the endpoint below to your harness: Claude Code, Codex, Claude, Cursor, ChatGPT, or another that supports MCP.
- Sign in to your Heavybit account with Google or GitHub when your agent asks. It's free, and your first sign-in creates the account.
- Tell your agent what you're working on. It finds the right skill, or you can ask for one by name.
MCP endpointhttps://crucible.heavybit.com/mcp
Heavybit Skill
Security Program Foundations
Built from seven library resources
How to start and scale a security program at a startup: what to prioritize, where security sits in the org, how to build security culture, and when to hire a CISO. Drawn from practitioners at HashiCorp, Snyk, HackerOne, and others.
Built from what these operators shared
- +8
Heavybit Skill
Security Compliance Program
Built from five library resources
Building a compliance program that satisfies enterprise customers and scales across frameworks. Covers SOC 2, ISO 27001, vendor security assessments, trust documentation, and GRC strategy. Drawn from practitioners at Vanta, Snyk, Everlaw, and others.
Built from what these operators shared
- +4
Heavybit Skill
Security Incident Response
Built from six library resources
Preparing for, managing, and recovering from security incidents: breaches, attacker compromise, data exposure, and regulatory response. Covers incident response plans, breach communications, regulatory obligations, and forensics coordination. Drawn from practitioners at HackerOne, Splunk, and others.
Built from what these operators shared
- +1
Heavybit Skill
Cloud Infrastructure Security
Built from two library resources
Practical cloud security controls for startups building on AWS, GCP, or Azure. Covers secure cloud environments, identity and access management, infrastructure-as-code, remote access strategies, and encryption decisions. Drawn from practitioners at HashiCorp, Datadog, and others.
Built from what these operators shared
- +2
Heavybit Skill
DevSecOps Practices
Built from six library resources
Embedding security into the software development lifecycle. Covers shift-left security, security in CI/CD pipelines, vulnerability management, application security strategy, and building security-aware engineering teams. Drawn from practitioners at Snyk, GitHub, CircleCI, and others.
Built from what these operators shared
- +4
Heavybit Skill
Software Supply Chain Security
Built from thirteen library resources
Securing the software supply chain from code signing to distribution. Covers provenance, dependency tracking, container image hardening, open source risk management, and the gap between corporate security tooling and open source ecosystems. Drawn from practitioners at Chainguard, Snyk, and others.
Built from what these operators shared
- +10
Connect your agent to Crucible, Heavybit's MCP server
One endpoint gives your agent every Heavybit Skill, a search of the Heavybit Library, and a direct line to Heavybit. Sign in free with Google or GitHub. Skills load when your agent needs them, so there is nothing to download or update.