portrait-clone

SUSPICIOUS. The core portrait-to-prompt behavior is coherent, but the optional execution path expands scope into third-party-mediated hosting, auth, and image generation via treg. The installer appears same-org and open-source, so this is not confirmed malware, yet the pipe-to-shell install, credential forwarding, and public hosting of reference portraits create meaningful security and privacy risk.