mcp-install-instructions-generator

The web component (src/component/index.ts) uses `allowDangerousHtml: true` for rendering markdown generated from user-provided URLs. This poses a potential Cross-Site Scripting (XSS) risk if malicious content can be injected via the URL or derived name attribute into the rendered HTML. Additionally, several instruction generators embed user-provided URL and name directly into shell commands or deep links (e.g., for `claude-code`, `codex`, `vscode`, `cursor`). While URL validation (using `z.string().url()`) is present, there is a potential for client-side command injection or deep-link exploitation if the input contains shell-specific special characters or carefully crafted payloads that are not adequately escaped by the target client environment when executing the generated instructions. No direct hardcoded secrets or 'eval' usage was found in the provided code.