Tomoviee Text to Video

Generate 5-second videos from text prompts using Tomoviee Text-to-Video API (tm_text2video_b) via Wondershare OpenAPI gateway (https://openapi.wondershare.cc...

Security Scan

The skill implementation and instructions match its stated purpose (text-to-video via the Tomoviee/Wondershare OpenAPI gateway); no surprising network endpoints, installs, or credential exfiltration appear in the code, though there are a couple of minor metadata/instruction mismatches to be aware of.

Purpose & Capability

Name/description, SKILL.md, and the included Python client all consistently implement calls to the Tomoviee API via the Wondershare gateway (openapi.wondershare.cc) for 5s text-to-video generation. The code requires an app_key and app_secret (passed to the client), which is appropriate and proportionate for this purpose.

Instruction Scope

SKILL.md instructs the agent/user to pip install requests and run the included scripts. Runtime actions are limited to sending API requests to openapi.wondershare.cc and polling the unified result endpoint. One noteworthy instruction: the API supports an optional 'callback' URL — if a user supplies a callback, the service may POST generation results (and any 'params' passthrough) to that URL, so users should avoid using untrusted callback endpoints to prevent unintended data exfiltration.

Install Mechanism

No install spec that downloads arbitrary code; only a small requirements.txt (requests). The skill is instruction+client-source-only and does not fetch executables from unknown hosts or use extract/download installers.

Credentials

The client requires an app_key and app_secret to authenticate, which is appropriate for an API client. However, the skill registry metadata declares 'Required env vars: none' and 'Primary credential: none' while the SKILL.md shows explicit authentication steps (passing app_key/app_secret). This metadata omission is a mismatch users should be aware of — credentials are needed at runtime even if not declared in the metadata.

Persistence & Privilege

The skill does not request persistent 'always' inclusion and does not modify other skills or system-wide settings. It does not persist credentials on its own or require elevated system privileges.

Assessment

This package appears to be a straightforward client for Tomoviee via the Wondershare OpenAPI gateway. Before installing or providing credentials: 1) Only provide an app_key and app_secret you trust (from your Tomoviee/Wondershare account). 2) Be cautious with the optional 'callback' URL — only use callback endpoints you control and trust, since the service will POST result data and any passthrough params there. 3) Note the registry metadata omits that credentials are required; treat the SKILL.md as authoritative and do not store secrets in shared or public places. 4) If you allow an autonomous agent to invoke this skill, remember the agent could make API calls using any credentials you supply — restrict those credentials' permissions or use test keys if possible.

Tomoviee AI Text-to-Video

Overview

Generate 5-second videos from text descriptions.

• API capability: tm_text2video_b
• Supported resolutions: 720p, 1080p
• Supported aspect ratios: 16:9, 9:16, 4:3, 3:4, 1:1
• Optional camera control: camera_move_index (1-46)

Provider and Endpoints

Use the following provider and endpoint mapping to keep credentials and routing consistent:

• Vendor portals: https://www.tomoviee.ai and https://www.tomoviee.cn
• API gateway host used by this skill: https://openapi.wondershare.cc
• Create-task endpoint pattern: https://openapi.wondershare.cc/v1/open/capacity/application/<capacity_id>
• Result endpoint: https://openapi.wondershare.cc/v1/open/pub/task

This skill sends API requests only to openapi.wondershare.cc.

Quick Start

Install dependencies

pip install -r requirements.txt

Authentication

python scripts/generate_auth_token.py YOUR_APP_KEY YOUR_APP_SECRET

Python Client

from scripts.tomoviee_text2video_client import TomovieeText2VideoClient

client = TomovieeText2VideoClient("app_key", "app_secret")

API Usage

Basic Example

task_id = client.text_to_video(
    prompt="Golden retriever running through sunlit meadow, slow motion, cinematic",
    resolution="720p",
    aspect_ratio="16:9",
    camera_move_index=5,
)

result = client.poll_until_complete(task_id)
import json
video_url = json.loads(result["result"])["video_path"][0]
print(video_url)

Parameters

• prompt (required): Text description (subject + action + scene + camera + lighting)
• resolution: 720p or 1080p (default: 720p)
• duration: duration in seconds (currently 5)
• aspect_ratio: 16:9, 9:16, 4:3, 3:4, 1:1
• camera_move_index: camera movement type (1-46, optional)
• callback: callback URL (optional)
• params: transparent passthrough params (optional)

Async Workflow

1. Create task: call text_to_video() and get task_id
2. Poll status: call poll_until_complete(task_id)
3. Parse result: read video URL from returned JSON

Status codes:

• 1 queued
• 2 processing
• 3 success
• 4 failed
• 5 cancelled
• 6 timeout

Typical generation time is 1-5 minutes per 5-second video.

Resources

scripts/

• tomoviee_text2video_client.py - Text-to-Video API client
• generate_auth_token.py - auth token generator

references/

• video_apis.md - detailed video API documentation
• camera_movements.md - camera movement index reference
• prompt_guide.md - prompt writing best practices

External Resources

• Developer portal (global): https://www.tomoviee.ai/developers.html
• API docs (global): https://www.tomoviee.ai/doc/
• Developer portal (mainland): https://www.tomoviee.cn/developers.html
• API docs (mainland): https://www.tomoviee.cn/doc/
• API host used by this skill: https://openapi.wondershare.cc