Fix external plugins board XSS

[mlasers0110-beep]

Pull Request Checklist

• I have read and followed the CONTRIBUTING.md guidelines.
• I have read and followed the Guidance for submissions involving paid services.
• My contribution adds a new instruction, prompt, agent, skill, workflow, or canvas extension file in the correct directory.
• The file follows the required naming convention.
• The content is clearly structured and follows the example format.
• I have tested my instructions, prompt, agent, skill, workflow, or canvas extension with GitHub Copilot.
• I have run npm start and verified that README.md is up to date.
• I am targeting the main branch for this pull request.

---

Description

Fix a stored XSS issue in the external plugins board canvas. Issue bodies are now sanitized before rendering, and PR links and label text are validated/escaped before being inserted into the DOM.

---

Type of Contribution

• New instruction file.
• New prompt file.
• New agent file.
• New plugin.
• New skill file.
• New agentic workflow.
• New canvas extension.
• Update to existing instruction, prompt, agent, plugin, skill, workflow, or canvas extension.
• Other (please specify):

---

Additional Notes

Added sanitize-html to support safe rendering of issue markdown content. Build output was regenerated as part of validation.

---

By submitting this pull request, I confirm that my contribution abides by the Code of Conduct and will be licensed under the MIT License.

[github-actions]

🟡 Contributor Reputation Check: MEDIUM risk

Check	Risk
Profile	MEDIUM
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

[Copilot]

Pull request overview

Hardens the external plugins board against stored XSS.

Changes:

• Sanitizes rendered issue Markdown.
• Validates PR URLs and escapes labels.
• Adds sanitizer dependencies and regenerates documentation.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
.github/extensions/external-plugins-board/extension.mjs	Adds sanitization and escaping.
package.json	Adds sanitize-html.
package-lock.json	Locks sanitizer dependencies.
docs/README.agents.md	Regenerates agent documentation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[aaronpowell]

Having external node packages on a canvas is tricky because they don't get installed when you use the canvas, you have to manually install them. Also, I'm going to delete the canvas as it's not used anyway.