gpt-image-gen

SUSPICIOUS. The core behavior matches an OpenAI image-generation skill and uses mostly official infrastructure, but the credential-discovery scope is broader than necessary and includes reading raw local auth files. No clear malware or third-party credential-harvesting endpoint is present, but the undocumented-style Codex backend path and broad local secret access raise medium security concerns.