Markdown reformat leaves XML-like plain text unescaped before ReportLab rendering

Summary

The Markdown reformat pipeline converts inline Markdown to ReportLab XML markup but does not escape plain text before passing it to ReportLab Paragraph. As a result, ordinary user text such as <b> is interpreted as ReportLab markup and can break PDF rendering.

Tested on OpenBMB/PilotDeck main at 0907c5c9ae66cc155f36775fc8472b3ea621880d.

Code path

• skills/minimax-pdf/SKILL.md:35 documents the REFORMAT route as reformat_parse.py followed by the CREATE pipeline.
• skills/minimax-pdf/scripts/reformat_parse.py:194 defines _md_inline as converting inline Markdown to ReportLab XML markup.
• skills/minimax-pdf/scripts/reformat_parse.py:197-205 performs regex substitutions for bold, italic, code, and links, but does not escape plain text.
• skills/minimax-pdf/scripts/render_body.py:608 passes body text directly to Paragraph(item["text"], ...).
• skills/minimax-pdf/scripts/make.sh:318 and :238 connect reformat_parse.py output to render_body.py.

Steps to reproduce

Run _md_inline("<b>"), then pass the result to ReportLab:

from reportlab.lib.styles import getSampleStyleSheet
from reportlab.platypus import Paragraph

converted = _md_inline("<b>")
Paragraph(converted, getSampleStyleSheet()["BodyText"]).wrap(200, 800)

Observed dynamic repro:

converted: "<b>"
ValueError: paragraph text '<para><b></para>' caused exception Parse error: saw </para> instead of expected </b>

A second minimal case, _md_inline("<"), produces a non-well-formed XML fragment when wrapped for markup parsing.

Expected behavior

Plain text in Markdown input should remain literal text after conversion. User text containing <, &, </b>, or <b> should not be interpreted as ReportLab markup unless the converter intentionally generated that markup.

Actual behavior

Plain XML-like text is emitted unescaped and can be parsed as ReportLab markup, causing renderer errors or malformed markup.

Existing coverage

I searched current issues and PRs for _md_inline, reformat_parse, ReportLab, Paragraph, and the expected </b> error text, and did not find an existing issue or PR covering this root cause. Open PRs do not modify skills/minimax-pdf/scripts/reformat_parse.py.

Related but not covering:

• #237 is about math formula rendering and does not modify reformat_parse.py or the plain-text escaping behavior.

Suggested fix

Tokenize supported Markdown spans, escape all ordinary text with html.escape(..., quote=False), and only emit allowed ReportLab tags generated by the converter itself.

Suggested tests

• Plain text containing <, &, <b>, </b>, and <tag>.
• Bold, italic, inline code, and links mixed with XML-special characters.
• A ReportLab Paragraph parse smoke test for converted body text.

---

Submitted with Codex.

Start with _md_inline in skills/minimax-pdf/scripts/reformat_parse.py:194 and reproduce the ReportLab Paragraph failure using the examples in the issue. Trace its output through skills/minimax-pdf/scripts/make.sh and render_body.py, then add coverage for XML-special characters, Markdown spans, and a Paragraph parse smoke test; done means plain text renders literally without errors.