icon-set-generator

No strong evidence of traditional malicious payload behavior (networking, subprocesses, credential theft) exists in this module. However, it directly embeds raw SVG markup from local files into an HTML page without sanitization/allowlisting, only stripping width/height from the first <svg> tag. As a result, if the SVG inputs (or the injected CSS/JS variables in the full code) are attacker-controlled, opening the generated preview.html can enable client-side script execution (XSS via script-capable SVG elements and/or inline event handlers) in the context of whoever views the preview artifact. Treat SVG inputs as trusted or implement strict SVG sanitization/neutralization before embedding; also verify the actual CSS/JS content used during generation.