possible XSS in skill-creator's templates.

I've used a security extension for Gemini CLI on the skill-creator, and the extension reported vulnerabilities on scripts that embeds a JSON on a '' tags without escaping '<' and '>'.
I know this is probably a minor issue, but i'm open one just to let you know.

## Vulnerability: Cross-Site Scripting (XSS) │
Line Content: return template.replace("/*__EMBEDDED_DATA__*/", f"const EMBEDDED_DATA = {data_json};") Description: The `generate_review.py` script embeds a JSON string into a `<script>` tag inside the HTML template without escaping `<` and `>`. If the JSON contains a string with `alert(1)`, it can break out of the script tag and execute arbitrary Javascript in the user's browser when they view the review page. │

Recommendation: Escape the JSON string before embedding it into the HTML document. Specifically, `data_json = json.dumps(embedded).replace("<", "\\u003c").replace(">", "\\u003e").replace("&", "\\u0026")` should be used.