.fetchmailrc

poll mail.morgn.net protocol POP3
    user "tim" with password "blablablabla" is tim here

crontab

* * * * * $HOME/myfetchmail.sh

move_spam.rb

require 'net/imap'

DEBUG = ARGV.include?('-d')
PASS = File.read(File.expand_path('.password', __dir__)).strip

imap = Net::IMAP.new('localhost')
imap.authenticate('LOGIN', 'tim', PASS)
imap.select('INBOX')
imap.search(['ALL']).each do |message_id|
  headers = imap.fetch(message_id, 'BODY.PEEK[HEADER.FIELDS (X-Spam-Status Subject)]')[0].attr.values.first
  if headers =~ /X-Spam-Status: Yes/
    subject = headers.match(/Subject: (.*)/)[1] rescue nil
    puts "moving to Spam: [#{message_id}] #{subject}" if DEBUG
    imap.copy(message_id, 'Spam')
    imap.store(message_id, '+FLAGS', [:Deleted])
  end
end
imap.expunge

myfetchmail.sh

#!/bin/bash

#tim@morgn:~ $ fetchmail
#1 message for tim at mail.morgn.net (2316 octets).
#reading message tim@mail.morgn.net:1 of 1 (2316 octets) flushed
#tim@morgn:~ $ fetchmail
#fetchmail: No mail for tim at mail.morgn.net

out=$(fetchmail 2>&1)
if echo "$out" | egrep "[0-9]+ message" &>/dev/null; then
  sleep 2 # not sure if this is really needed
  ruby $HOME/move_spam.rb
elif echo "$out" | egrep "No mail" &>/dev/null; then
  exit
else
  echo "$out"
fi