So I am creating a simple website stored in a public GitHub repo that will be hosted on GitHub pages.

Included within it is an EmailOctopus form that links to a mailing list. The code provided by EmailOctopus to insert in my index.html takes the following form:

<script async src="https://eocampaign1.com/form/[UNIQUE ID].js" data-form="[UNIQUE ID]"></script>

Question 1: Is it safe to have this link in a public GitHub repo? I know not to store API keys in a public repo, but this seems to be safe as I assume the worst that can happen is someone spams a bunch of emails into the list (I have reCaptcha enabled to help prevent this). Is this correct?

My intention for this site is that it can serve as a template for other people to use (i.e., they fork my GitHub repo and update the EmailOctopus link with their own). Given I expect the users to be non-technical, to make it as easy as possible for them I have added an input.js file containing easy to edit variables which the index.html will reference. My intention is to have a variable where they can store their EmailOctopus link i.e.,:

const emailOctopusLink = '<script async src="https://eocampaign1.com/form/[UNIQUE ID].js" data-form="[UNIQUE ID]"></script>'

Question 2: I plan to use innerHTML to refer to this EmailOctopusLink variable in my index.html. I don’t know much about XSS, but I want to ensure that in this example innerHTML is a safe thing to do (especially given it will be hosted in a public GitHub repo).

Thanks for any help!

TL;DR: Is it safe to have 3rd party service form links (non-API) in a public GitHub repo and is it safe to use innerHTML to call it?