Here comes a script tag... <script>alert("xss from the readme")</script> ...there it went.