line-bot-mcp-server

The server correctly uses environment variables for sensitive tokens. However, the `create_rich_menu` tool utilizes Puppeteer with the `--no-sandbox` argument to render rich menu images, where user-provided `chatBarText` and action `label` fields are embedded into an HTML template. While input validation (Zod) is present for general structure, if malicious HTML/JavaScript is injected into these text fields and not sufficiently sanitized by the Marp rendering process, it could potentially be executed within the unsandboxed Puppeteer instance, posing a security risk. This is noted as a preview version, suggesting it may not be production-hardened.