You should escape everything, just in case. Exceptions are of course in places you really want to allow unfiltered html. For this plugin this is the mostly the `do_shortcode( $content )` part

You can (and should) use esc_url() wifh ID's / hash links as well. You just need run the hash through the function.

`esc_html( 'test )` outputs `http://test`
`esc_html( '#test' )` outputs `#test`