job-search

Legitimate job-application automation pipeline with no obvious embedded malware in the provided fragments. Primary security issues are privacy and trust boundaries: unfiltered transmission of sensitive candidate data to external LLM services and use of a Notion token to write data remotely. Additional operational risks: potential prompt-injection via untrusted job descriptions, lack of file-locking for seen-jobs.json, and use of broad pkill commands. Recommend: avoid sending sensitive data to untrusted LLM endpoints, use scoped/rotating Notion tokens and secrets management, sanitize inputs before building prompts, add atomic file writes/locks, and restrict destructive shell commands.