fix: sanitize_label double-encoding and --wiki missing from skill (#66, #55)

graphify/security.py

@@ -186,13 +186,12 @@ _MAX_LABEL_LEN = 256
 
 
 def sanitize_label(text: str) -> str:
-    """Strip control characters, cap length, then HTML-escape.
+    """Strip control characters and cap length.
 
-    Applied to all node labels and edge titles before they are embedded
-    in pyvis HTML output or returned via the MCP server, preventing both
-    XSS and broken visualisations from malformed source identifiers.
+    Safe for embedding in JSON data (inside <script> tags) and plain text.
+    For direct HTML injection, wrap the result with html.escape().
     """
     text = _CONTROL_CHAR_RE.sub("", text)
     if len(text) > _MAX_LABEL_LEN:
         text = text[:_MAX_LABEL_LEN]
-    return html.escape(text)
+    return text