receipt-expense-workflow

No clear evidence of overt malware (no network exfiltration, shell execution, or credential/data theft) is present in this module’s logic. The primary security risk is handling of untrusted ZIP archives: using ZipFile.extractall(tmpdir) without validating member paths can enable ZIP Slip/path traversal or extraction-time sabotage. Secondary concerns include availability risk from unbounded OCR/PDF processing and supply-chain risk inherent to executing third-party OCR/PDF-processing dependencies (surya/pypdfium2).