Heavybit Skill
Software Supply Chain Security
Securing the software supply chain from code signing to distribution. Covers provenance, dependency tracking, container image hardening, open source risk management, and the gap between corporate security tooling and open source ecosystems. Drawn from practitioners at Chainguard, Snyk, and others.
Built from what these operators shared
Software Supply Chain Security
Built from thirteen library resources
What a skill is
A skill is a set of working instructions your agent loads when you need it, built from the strategies operators shared in the Heavybit Library. It guides the work and you still do it. Heavybit reads and approves every skill before it ships, and keeps updating skills as new content enters the Library. Skills are plain text, so you or your agent can read any skill in full before acting on it. Your agent decides how to apply a skill, so check its work; if a skill gets something wrong, ask your agent to report it or email platform@heavybit.com.
Connect your agent
- Add the endpoint below to your harness: Claude Code, Codex, Claude, Cursor, ChatGPT, or another that supports MCP.
- Sign in to your Heavybit account with Google or GitHub when your agent asks. It's free, and your first sign-in creates the account.
- Tell your agent what you're working on. It finds the right skill, or you can ask for one by name.
MCP endpointhttps://crucible.heavybit.com/mcp
Built from the Heavybit Library
The operators behind this skill shared what they know in these talks, podcasts, and articles. Every one is free in the Heavybit Library.
- Podcast
Sigstore with Dan Lorenc of Google
AUG 25, 2021With Dan Lorenc
In episode 20 of The Kubelist Podcast, Marc and Benjie are joined by Dan Lorenc of Google. They discuss supply chain security and the Sigstore project, a new standard for signing, verifying and protecting software.
The Kubelist Podcast · Ep. 20
Sigstore with Dan Lorenc of Google
Listen52 MIN
- Podcast
Open Source Security with Jeff McAffer of Microsoft
APR 4, 2019With Jeff McAffer
In episode 27 of The Secure Developer, Guy is joined by Jeff McAffer, director of Microsoft’s Open Source Programs Office, who shares his insights on how to keep open source projects sustainable and secure for the whole community.
The Secure Developer · Ep. 27
Open Source Security with Jeff McAffer of Microsoft
Listen31 MIN
- Podcast
Securing Environment Variables with Dante Lex of Onboardbase
AUG 25, 2022With Dante Lex
In episode 108 of JAMstack Radio, Brian Douglas speaks with Dante Lex of Onboardbase. Together, they discuss environment variables and the tools and practices used to secure them. This conversation includes lessons on infrastructure tools, observability,…
Jamstack Radio · Ep. 108
Securing Environment Variables with Dante Lex of Onboardbase
Listen23 MIN
- Podcast
Reproducible Infrastructure with Graham Christensen
MAY 28, 2026With Graham Christensen
On episode 38 of Open Source Ready, Brian Douglas and John McBride speak with Graham Christensen, CEO of Determinate Systems, about the evolution of the Nix ecosystem and why more organizations are embracing reproducible infrastructure. They discuss secure…
Open Source Ready · Ep. 38
Reproducible Infrastructure with Graham Christensen
Listen43 MIN