Identify concerns if a malicious account were scanned

In developing CloudMapper, I have not really considered the idea of what would happen if a malicious account were scanned. Specifically, could it be possible to cause something like XSS if someone names an IAM user (or other resources) maliciously, such that when a report is generated, that it somehow can do something unexpected? Are there other areas that could be impacted by a malicious attacker? Are there mitigations I can put in place?