omni-image

The code appears to be a functional AI image CLI, not malware. The embedded Google API key is a credential exposure, and unvalidated batch output names can write outside the intended output directory when the manifest is untrusted. Use a restricted or trusted manifest and remove or rotate the embedded key.