Tomoviee Tail to Video

Generate videos from first and last frame images using Tomoviee First-Last Frame API (`tm_tail2video_b`) via Wondershare OpenAPI gateway (`https://openapi.wo...

Security Scan

The skill does what it claims (wraps Tomoviee first-last-frame API via openapi.wondershare.cc) and its code and instructions are consistent with that purpose, with only minor metadata/documentation mismatches to be aware of.

Purpose & Capability

The skill's name and description match the included client code and SKILL.md: it implements tm_tail2video_b via the Wondershare gateway. One minor inconsistency: the registry metadata lists no required env vars/credentials, but the SKILL.md and code clearly require an app_key and app_secret (passed to the client). This is a documentation/metadata mismatch rather than a functional mismatch.

Instruction Scope

SKILL.md and the code only instruct creating tasks, polling for results, and returning the video URL. The code does not read unrelated files or environment variables, does not write secrets to disk, and only contacts the documented endpoints on openapi.wondershare.cc. The optional callback parameter can cause the provider to contact an external URL (expected for callback usage).

Install Mechanism

This is instruction-plus-source (no automated install spec). The only runtime dependency is requests (requirements.txt). No remote downloads, no archive extraction, and nothing is written to disk by the skill beyond normal runtime state.

Credentials

The functionality legitimately requires an app_key and app_secret (used to form a Basic auth header). However, the skill metadata in the registry did not declare required env vars or a primary credential; SKILL.md expects credentials passed to the client. Also note the optional 'callback' parameter — if set to a user-controlled external URL, the provider may send results there (expected behavior but a potential data-forwarding vector).

Persistence & Privilege

always is false; the skill does not request persistent system privileges or modify other skills or global agent settings. It does not enable itself or store auth tokens to disk.

Assessment

This package is internally consistent with its stated purpose: it builds Basic auth from app_key/app_secret and posts to openapi.wondershare.cc to create and poll tasks. Before installing or using it, consider: 1) supply credentials only for a verified Tomoviee/Wondershare account and avoid pasting production keys into third-party or unknown code until you confirm the provider and owner; the registry metadata omits declared credential requirements even though the SKILL.md/code require app_key/app_secret. 2) The optional callback parameter can forward results to any URL you provide — do not use untrusted callback endpoints if your inputs (images, prompts) are sensitive. 3) The skill owner and homepage are unknown; verify the vendor docs (links provided in SKILL.md) and test with limited or expendable credentials first. 4) The code does not persist secrets to disk, but you should still avoid committing keys to source control. If you want stronger assurance, ask the publisher to update registry metadata to declare required credentials and provide a verified homepage or publisher identity.

Tomoviee AI First-Last Frame to Video

Overview

Generate a 5-second video from two keyframe images:

• image: first frame
• image_tail: last frame

API capability: tm_tail2video_b

Provider and Endpoint Provenance

Use this mapping to verify provenance before using production credentials:

• Vendor portals: https://www.tomoviee.ai and https://www.tomoviee.cn
• Runtime API gateway host used by this skill: https://openapi.wondershare.cc
• Create endpoint: https://openapi.wondershare.cc/v1/open/capacity/application/tm_tail2video_b
• Result endpoint: https://openapi.wondershare.cc/v1/open/pub/task

This skill sends runtime API requests only to openapi.wondershare.cc.

Credential Handling

• Sensitive credentials required: app_key and app_secret.
• Credentials are only used to build Authorization: Basic <base64(app_key:app_secret)>.
• Credentials are kept in process memory only and are not written to disk by this skill.
• Do not hardcode credentials in source files or commit them to git.

Required Inputs

• Credentials: app_key, app_secret
• Generation inputs: prompt, image, image_tail

Scope

• This skill only covers tm_tail2video_b (first-last frame to video).
• Output duration is fixed to 5 seconds by API design.
• This skill does not implement text-to-video, image-to-video, or video continuation APIs.

Dependencies

• Runtime dependency: requests>=2.31.0,<3.0.0
• Install with: pip install -r requirements.txt

Quick Start

Install dependencies

pip install -r requirements.txt

Authentication helper

python scripts/generate_auth_token.py YOUR_APP_KEY YOUR_APP_SECRET

Python Client

from scripts.tomoviee_firstlast2video_client import TomovieeFirstLast2VideoClient

client = TomovieeFirstLast2VideoClient("app_key", "app_secret")

API Usage

Basic Example

task_id = client.firstlast_to_video(
    prompt="Scene transitions naturally from first frame to last frame with smooth motion",
    image="https://example.com/first-frame.jpg",
    image_tail="https://example.com/last-frame.jpg",
    resolution="720p",
    duration=5,
    aspect_ratio="original",
)

result = client.poll_until_complete(task_id)
import json
video_url = json.loads(result["result"])["video_path"][0]
print(video_url)

Parameters

• prompt (required): Motion guidance text.
• image (required): First frame image URL.
• image_tail (required): Last frame image URL.
• resolution (optional): 720p or 1080p, default 720p.
• duration (optional): only 5 is supported.
• aspect_ratio (optional): 16:9, 9:16, 4:3, 3:4, 1:1, original.
• camera_move_index (optional): camera movement type 1-46.
• callback (optional): callback URL.
• params (optional): transparent callback parameter.

Image Constraints

• File size: each image must be <200M
• Formats: JPG, JPEG, PNG, WEBP
• Recommended resolution: at least 720p source quality

Async Workflow

1. Create task and get task_id
2. Poll with poll_until_complete(task_id)
3. Parse video URL from result

Status codes:

• 1 queued
• 2 processing
• 3 success
• 4 failed
• 5 cancelled
• 6 timeout

Resources

• scripts/tomoviee_firstlast2video_client.py - main API client
• scripts/generate_auth_token.py - auth token helper
• references/video_apis.md - API reference and constraints
• references/camera_movements.md - camera movement index reference
• references/prompt_guide.md - prompt writing guidance

External Resources

• Developer portal (global): https://www.tomoviee.ai/developers.html
• API docs (global): https://www.tomoviee.ai/doc/ai-video/first-and-last-frame-to-video.html
• Developer portal (mainland): https://www.tomoviee.cn/developers.html
• API docs (mainland): https://www.tomoviee.cn/doc/ai-video/first-and-last-frame-to-video.html