feat(skills): add MiniMax-AI/cli as default skill tap

[octo-patch]

Summary

• Add MiniMax-AI/cli (skill/ path) to the bundled skills list in bundled.rs so the mmx-cli skill ships with OpenFang out of the box
• Users can install via ClawHub or use it immediately as a bundled skill — the SKILL.md is embedded directly from MiniMax-AI/cli
• Skill updates are fully decoupled: MiniMax maintains the upstream SKILL.md, and the bundled copy can be refreshed on the next OpenFang release

2 files changed: 1 new SKILL.md + 1 line in bundled.rs (+ test count update).

What is mmx-cli?

mmx-cli is a CLI tool for the MiniMax AI platform, providing:

• Text generation (MiniMax-M2.7 model)
• Image generation (image-01)
• Video generation (Hailuo-2.3)
• Speech synthesis (speech-2.8-hd, 300+ voices)
• Music generation (music-2.6, with lyrics, cover, and instrumental)
• Web search

The SKILL.md follows the agentskills.io standard and includes agent-specific flags (--non-interactive, --quiet, --output json).

Test plan

• cargo test -p openfang-skills passes (bundled count updated to 62)
• mmx-cli skill loads and parses successfully via test_all_bundled_skills_parse
• mmx-cli skill passes security scan via test_bundled_skills_pass_security_scan

[jaberjaber23]

Thanks @octo-patch — reviewed carefully because "default skill tap" sounds like a supply-chain vector, and the good news is: it isn't. The diff vendors a static SKILL.md into crates/openfang-skills/bundled/mmx-cli/ via include_str!(). No remote fetch at runtime, no auto-install of binary code. The risk surface is only the documentation content itself (which suggests npm install -g mmx-cli if the user copies the command — exactly the same risk as any other bundled skill).

Conditions to merge:

1. Pin provenance. Please add a line at the top of the vendored SKILL.md (or in a PROVENANCE sibling file) with:
   • Upstream repo URL (https://github.com/MiniMax-AI/cli)
   • Exact commit SHA of the upstream file at the time you vendored it
   • Date of vendor
     This way we can diff against upstream when refreshing.
2. CI is red — rebase on current main (post-fix(deps): upgrade wasmtime 41->43 and rumqttc 0.24->0.25 to resolve active CVEs #1041) to re-trigger checks.
3. Confirm the upstream repo is the real MiniMax-AI org, not a typosquat. One of the maintainers will double-check before merge.

Once (1) and (2) are done, happy to land.