To avoid problems like T338094: Dom based reflected XSS at https://api.wikimedia.org/service/linkrecommendation/apidocs/, the Swagger sandbox for the linkrecommendation API should come with restrictive CSP rules which disallow fetching resources from another domain.
(The same probably goes for other api.wikimedia.org APIs as well, but the mechanism of achieving it might differ from API to API.)