openspeccer

The code has a potential HTML injection vulnerability: `prefix` is inserted unescaped into heading IDs before the resulting HTML is passed to `dangerouslySetInnerHTML`. Risk depends on whether callers can supply an untrusted prefix. Other visible rendering paths apply escaping or restrict link protocols; no evidence of malware, data exfiltration, or obfuscation is present.