duolingo-character-style

This code generates character illustrations and serializes them as SVG. It directly interpolates caller-supplied values into SVG markup without escaping, creating an injection/XSS risk if untrusted values are serialized and rendered as HTML or SVG. No malware indicators, network destinations, credentials, or system-modifying behavior are present; severity is conditional on caller input and rendering context.