respring-content-mcp

The server explicitly disables HTML escaping for Mustache templates (`Mustache.escape = (text: string) => text;`). This means any content provided to the `generate_one_pager` or `generate_infographic` tools, if it contains malicious HTML or JavaScript, will be rendered directly without sanitization. If the content input is not strictly controlled and sanitized by the caller (e.g., an LLM generating arbitrary text for template fields), this creates a severe Cross-Site Scripting (XSS) or HTML injection vulnerability. Output paths for generated files (`RESPRING_OUTPUT_DIR`) are controlled, mitigating arbitrary file system writes. No 'eval' or direct command injection patterns were found in the server's core logic.