oss-forensics-orchestration

SUSPICIOUS: the overall workflow is broadly aligned with OSS forensics, but the footprint is somewhat disproportionate because it requires Google Cloud credentials and executes unseen local Python from a prebuilt virtualenv without provenance details. Data flows largely match the purpose and there is no clear evidence of credential theft or malware, but the combination of hidden local execution, cloud-auth dependence, and untrusted external-content processing creates medium security risk.