spam-nuke

An agent skill that maps a spammer's entire supply chain (mailboxes, sending platform, domains, lead vendor, voice carrier, regulators) and reports them to every layer of it. Every channel it uses is an official one: abuse desks, blocklists, carrier traceback and regulators that exist specifically to receive these reports. No hacking, no harassment, no gray areas.

Why: a dark forest for spammers

Spam runs on an asymmetry. Sending is nearly free, and fighting back costs the recipient an hour of header-reading, WHOIS lookups and web forms. So almost nobody fights back, and the expected cost of hitting any one inbox is roughly zero.

Agents remove the recipient's cost. With this skill, "nuke this spammer" takes one sentence. Spammers can't tell which inboxes have an agent behind them, so every message they send becomes a lottery ticket for an expensive event:

• a suspended Google Workspace tenant and weeks of mailbox warmup lost
• a terminated sending-platform account
• their brand domain on Spamhaus, which hurts all their mail, invoices included
• a traceback that gets their voice carrier cut off from the US phone network
• a regulator file with their name on it, or statutory damages per message

expected cost per message = P(recipient is armed) × cost of a full-stack response

Agents raise P. Hitting the whole supply chain, instead of one throwaway address, raises the cost. Past a certain point the rational move for senders is the one from Liu Cixin's Dark Forest: don't reveal yourself. In practice that means only emailing or calling people who opted in.

This works because the systems already exist. Abuse desks, Spamhaus, the FCC's traceback machinery and the FTC's complaint database all have thresholds and penalties built in. What they've been short of is input. It also only works if reports are accurate, which is why the skill is strict about evidence (see below).

The full layer-by-layer reasoning, with sources, is in references/supply-chain.md.

The supply chain it hits

It covers email (cold outreach, spam, phishing), calls (robocalls, voicemail) and texts, with channels for the US, EU, UK, Canada, Australia and Singapore.

Works with any agent, any tools

Any agent that can read a SKILL.md can use it, and it doesn't assume particular tools. The agent uses whatever it has: mail access to pull raw messages and send abuse reports, a browser for government web forms, a shell for DNS/WHOIS, and phone or messaging access for call logs and texts. If it can't reach a channel, it writes the filled-in draft and adds it to your checklist.

# Claude Code
git clone https://github.com/menhguin/spam-nuke ~/.claude/skills/spam-nuke

# Hermes
git clone https://github.com/menhguin/spam-nuke ~/.hermes/skills/spam-nuke

For any other agent, put the folder where it loads skills from, or give it the link and say "read SKILL.md and follow it". Then say "nuke this spammer", "do something about the spam calls in my voicemail", or "report this phishing text".

Guardrails (precision is the weapon)

• Checks you didn't sign up. The agent searches your inbox for prior contact first and unsubscribes instead if you opted in. False positives are what teach abuse desks to ignore reports.
• Claims only what the evidence shows, under the law that applies. Example: in the US, unsolicited email isn't illegal by itself (CAN-SPAM is an opt-out law), so the agent cites real violations, or platform-policy breaches, rather than inventing them.
• One report per channel per incident, tracked in a ledger. Repeat offenders get escalated, not re-spammed with reports.
• Never engages with scams: no replies, link clicks or callbacks. With real, identifiable companies it may send one official opt-out, because mail after that is a clean violation.
• Discloses that an agent prepared each report, with your real contact details.
• Asks once before sending, unless you've told it to file on its own. Lawsuits (TCPA, California and Washington email laws) are prepared as evidence only; filing is your call.

Contents

Abuse addresses and form URLs move, so the agent confirms each one before sending. PRs with updated contacts or new sequencer fingerprints are welcome.

MIT licensed.