requirements-doc

This Markdown renderer has HTML injection risks: untrusted link destinations can use `javascript:`, and recognized anchor IDs are inserted into HTML attributes without escaping. These can enable script execution when the returned HTML is rendered in a browser; no malware, data theft, or external communications are evident in this fragment. Severity is a security warning dependent on whether untrusted Markdown is rendered.