make-explainer

This module provides HTML/Markdown formatting helpers and fixed SVG glyphs. The main security concern is chip(), which interpolates tone into an HTML attribute without validation; if untrusted input reaches tone and the result is inserted into a page, this can enable HTML injection or XSS. Labels are escaped and glyph names resolve only to fixed markup. No credential access, network activity, filesystem operations, or other evidence of malware is present; severity is conditional on caller-controlled tone reaching an HTML sink.