SearchAndApplyJobs

The server uses `read_file`, `read_resume_pdf`, `read_document`, and `save_cover_letter` functions that take user-provided file paths. If the MCP server is exposed to untrusted external input (e.g., via an LLM generating arbitrary paths), this could lead to directory traversal or unauthorized file system access (read/write). The `scrape_job_posting` tool takes an arbitrary URL, which could be exploited for Server-Side Request Forgery (SSRF) if the URL is not validated. The `ddgs` library performs external network requests, which can be a network risk if not contained. The hardcoded date filter in `search_jobs` (`after:2024-11-01`) is a functional issue, not a security one.