Cull

simota/cull

Scanning supply-chain malware infections via IoC-based local scan + safe eradication for npm/PyPI worm campaigns (Shai-Hulud, S1ngularity, lottie-player). Detects OS persistence (LaunchAgent/systemd), IDE-hook implants (.claude/.vscode/.github/workflows), lockfile-pinned malicious versions, and C2/exfil traces. Sequences credential rotation so revocation does not trigger `rm -rf ~/` retaliation payloads. Use when worm infection is suspected. Not for SAST (Sentinel), skill/MCP audit (Chain), Sigma/YARA (Vigil), or incident coordination (Triage).

20k tokens

context cost

the whole folder, loaded on every use

files

instructions only

copies elsewhere

how many repositories repackaged it

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/simota/agent-skills --skill cull

How to use it

Copy the folder

Take simota/cull from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.

Install what it needs

The instructions reference npm. Without those the skill loads but fails at the first command.