$indexlink = Linker::link( $nt, $out->msg( 'proofreadpage_source' )->text(), [ 'title' => $out->msg( 'proofreadpage_source_message' )->text() ] );
The deprecated Linker does not escape the text - if you switch to LinkRenderer then it will do it for you (or use ->escaped() ).
phan-taint-check-plugin is complaining about two potential SQLi's but my quick look made it seem like they were false positives. (A more thorough look would be appreciated)
<checkstyle version="6.5">
<file name="./ProofreadPage.body.php">
<error line="523" severity="warning" message="Calling method \Linker::link() in \ProofreadPage::prepareArticle that outputs using tainted argument $[arg #2]. (Caused by: ../../includes/Linker.php +113)" source="SecurityCheck-XSS"/>
</file>
<file name="./includes/Page/ProofreadPageDbConnector.php">
<error line="37" severity="error" message="Calling method \Wikimedia\Rdbms\Database::select() in \ProofreadPage\Page\ProofreadPageDbConnector::queryCount that outputs using tainted argument $[arg #1]. (Caused by: ../../includes/libs/rdbms/database/Database.php +1638) (Caused by: ./includes/Page/ProofreadPageDbConnector.php +35; ./includes/Page/ProofreadPageDbConnector.php +37)" source="SecurityCheck-SQLInjection"/>
<error line="37" severity="error" message="Calling method \Wikimedia\Rdbms\Database::select() in \ProofreadPage\Page\ProofreadPageDbConnector::queryCount that outputs using tainted argument $[arg #2]. (Caused by: ../../includes/libs/rdbms/database/Database.php +1638) (Caused by: ./includes/Page/ProofreadPageDbConnector.php +35; ./includes/Page/ProofreadPageDbConnector.php +37)" source="SecurityCheck-SQLInjection"/>
</file>
</checkstyle>