I don't think that passing unescaped alt is a good idea. There is a possibility of XSS via custom user link text, for example:
```
[" onclick="javascript:xss" attr="](http://url)
```