htmlsafeslip parses Ruby source with Ripper to find a call to `.html_safe` directly on an expression, or a `raw(...)` wrapping one, where that expression is traceable (directly, or via a same-method local-variable assignment) to `params[...]`/`params.dig(...)`, with no `sanitize(...)`/`strip_tags(...)`/`h(...)`/`ERB::Util.html_escape(...)` call applied to it first. Both `.html_safe` and `raw(...)` tell Rails' view layer "this string is already safe HTML, don't auto-escape it" -- calling either directly on unsanitized, user-controlled input defeats Rails' single biggest built-in XSS defense, turning a reflected or stored script-tag payload into live, executing HTML the instant it's rendered.