public static function specialLink( $name, $key = '' ) {
if ( $key == '' ) {
$key = strtolower( $name );
}
return self::linkKnown( SpecialPage::getTitleFor( $name ), wfMessage( $key )->text() );
}->text() should actually be ->escaped(). I don't think this is exploitable aside from making a text message into a raw HTML one.
The usage in the Nostalgia skin and WikimediaIncubator extension look fine to me,
(Noticed after csteipp pointed out that the new Linker rewrite should escape by default)