klad, posted to Hacker News on November 11, 2026, is a paint and animation studio built for joint human–agent work: you draw with a pen; your coding agent issues klad shell commands on the same canvas. The GitHub repository is source-available (PolyForm Internal Use License with revenue thresholds, not OSI open source) and ships MIT-licensed agent skills plus a documented CLI that reads and writes stroke JSON. There is no cloud account and no generative image model—only local files and commands. For security readers, that makes klad a useful example of how benign creative tooling still grows skill supply-chain and shell reach on the machine where Claude Code or Codex runs.
Similar skill-pack patterns appear in Addy Osmani's agent-skills workflows on explainx.ai and Beam's Google Chrome modern web guidance for skills post.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Only if you clone klad and point a coding agent at its skills or PATH |
| Is there a CVE? | None reported—risk is operational (agent shell + skills), not a disclosed vuln |
| Does data leave my machine? | No by default—drawings are local folders; optional daily update check can be disabled per README |
| What should I scan? | docs/skill/*.md, install scripts, and any prompt telling the agent to run just compile |
| What should I deny? | Unexpected curl, package installs, or edits outside the drawing directory during agent sessions |
What klad adds to an agent workflow
Human and agent on one drawing
The README describes a loop:
- Ask the agent in plain language for art (props, characters, backgrounds).
- Watch strokes appear in the editor ~1 second after CLI commands.
- Annotate with pinned notes (
klad notes) or selections the agent can read. - Take over manually—agent strokes stay marked with shared undo history.
Unlike pixel generators, each stroke remains editable data (path, pressure, brush, colour). Agents can issue thousands of strokes; the README cites a demo with 4,344 strokes and fills for a “sprout creature” plus animation keys.
CLI parity with the editor
Everything in the UI has a CLI equivalent. Examples from the README:
klad stroke art.klad l4 --brush oil --path 'M100 400 C 300 200 500 600 700 400'
klad set art.klad c4:s12 size=3.5 color=#3355aa
klad strokes art.klad l4 --json
klad export art.klad --godot ../game/art
docs/format.md (MIT) and docs/cli.md document the on-disk format and commands; crates/client offers a Rust helper for batch JSON ops. Agents therefore gain structured write access to arbitrary directories you point them at—not just drawing semantics.
Bundled skills (supply chain)
Operators run:
klad skill
klad skill drawing
These print docs/skill/SKILL.md (tool use, inspecting results) and docs/skill/drawing/SKILL.md (craft guidance). Both are MIT licensed so they can ship inside any agent harness. The recommended kickoff prompt in the README literally tells the agent to read those outputs, create scene.klad, and paint a night scene—classic skill + high-volume tool call pattern.
Install footprint
First-time build via just compile takes ~10 minutes per README (Rust toolchain, Linux font/X11 deps). klad install puts binaries on PATH for user and agent; on macOS that may prompt for sudo.
Drawings are git-friendly folders; agents with repo access can commit art assets alongside code.
Animation, games, and export paths
Beyond static illustration, klad targets game art pipelines:
- In-betweens from key poses (
klad inbetweenwith layer lists and spacing modes). - Arc checks for foot slide and grounding (
klad arcs --check). - Godot export via
klad export art.klad --godot ../game/artproducingSpriteFrameswith clip timing.
Each step is another filesystem write the agent may chain after painting. If your game repo is also where production secrets live, separate art experiments from infrastructure directories—the same discipline as keeping .env out of agent-readable trees in Railway-style secret hunts.
The README emphasizes stroke-level edits instead of rerolling pixels: recolor one leaf, bend a mouth, move a smudge. That reduces model spend but increases command volume—monitor token and tool-call budgets when agents paint thousands of strokes.
License and distribution constraints
Security reviews often skip license sections; klad's terms affect who may compile and share builds:
- Core app: PolyForm Internal Use License 1.0.0 with additional permissions and a €500,000 revenue cap before requiring a purchased license per person using it commercially.
- MIT applies only to format docs, CLI reference,
docs/skill/, andcrates/client/—the pieces agents most commonly copy.
Agents cannot lawfully redistribute binaries or source builds outside those terms even if technically able to zip the folder. Compliance and security both benefit from recording who built klad from source on corporate laptops.
Build, audit, and quality scripts
The README documents maintainer commands relevant to supply-chain hygiene:
just build
just test
just lint
just audit
just samples
just audit covers licenses, RustSec advisories, sources, and notices per repo text. Before you trust a first release binary compiled locally, run audit in the clone and inspect deny.toml—the same hygiene you would demand from a Rust CLI pulled in via cargo install for an agent plugin.
Linux builds require fontconfig, freetype, xkbcommon, wayland dev packages; macOS is the primary tablet platform today. Running agents as root to klad install on macOS expands blast radius if the agent later runs unrelated commands in the same sudo-granted session.
Threat model (local, practical)
klad is not malware research—it is dual-use developer tooling. Risks map to any powerful local CLI:
| Stage | Risk | Mitigation |
|---|---|---|
| Clone / build | Supply-chain during cargo fetch | Use pinned Rust toolchain in repo; review deny.toml / just audit scripts README lists |
| Skill load | MIT skills could be copied maliciously elsewhere | Scan before adding to global skills; compare hashes to upstream repo |
| Agent session | Shell can run any command, not only klad | Enforce cwd, use hooks to deny unexpected network installs |
| Shared projects | .klad paths in prompts may escape to parent dirs | Keep art in a dedicated directory; deny ../ writes if policy supports it |
| Export | klad export --godot writes into game trees | Review exports before committing |
The README's optional once-a-day version check can be disabled—relevant for air-gapped studios.
What developers are saying
The Show HN discussion stays mostly product-focused:
- chaostheory wonders whether agents might embed subtle “watermarks” in hand-drawn strokes—a creative integrity question, not a CVE, but relevant if you use agent art in shipping assets.
- rchrp asks about generation time and tool-call volume—operational metrics that matter when you meter agent spend.
No commenter in the first batch reported malicious behavior in the repo; still treat first public release software as immature attack surface (preview bone tooling, missing SVG import per README “What’s rough”).
What this means if you run AI coding agents
Before you paste the README prompt:
- Read
docs/skill/SKILL.mdyourself—do not let the agent load unseen skill text into a trusted global path (maliciousAGENTS.mdpatterns are the same class of problem). - Run your skill scanner on those files if your team uses Beam or similar (skill testing cookbooks describe the genre).
- Scope the working directory so
klad export --godot ../game/artcannot write outside the game repo you intend. - Watch compile-time supply chain—first build pulls many crates; run on a machine you can afford to wipe if experimenting.
- License check—PolyForm Internal Use limits companies above €500,000 revenue unless they buy a license; legal review is separate from security but affects corporate use.
During sessions, prefer observe mode on hooks until you trust the agent's klad command patterns, especially if it starts chaining klad with curl or package installs suggested in unrelated prompts.
Suggested workspace layout
A low-friction pattern that keeps risk visible:
- Create
~/art/klad-lab/outside production monorepos. - Clone once; pin
rust-toolchain.tomlfrom the repo. - Copy skill text into the project-local
.claude/skills/or equivalent after review, not into global skill directories. - Add
klad-lab/to your agent allowlist file if you use one; deny../relative exports in hook rules where supported.
When collaborating, remember drawings are folders of plain files—diff them like code. Unexpected binary blobs or new network calls inside a .klad tree warrant the same suspicion as unfamiliar dependencies in package.json.
Comparison to image-generation workflows
Teams using image models for concept art get fast pixels but weak editability. klad inverts the tradeoff: slower for novices, precise for iteration. Security-wise, image APIs send prompts off-device; klad keeps data local, which helps privacy but does not reduce shell power—the agent still runs with your user privileges.
If you already block cloud image APIs via policy, klad may still be allowed while improving auditability (every stroke logged as JSON). Pair that win with command logging on the harness side.
When to skip klad in agent pipelines
klad is a poor fit for unattended CI agents: builds are heavy, the editor expects human pairing, and animation QA needs eyes on timing. Security champions should discourage adding klad skill output to global agent defaults unless artists own the maintenance burden. For repos that only need static marketing PNGs, conventional export pipelines may carry less shell exposure than teaching an agent paintercraft through a multi-thousand-stroke session.
What Beam can and cannot do here
Beam applies on the agent harness, not inside klad:
- Skill/MCP heuristics can flag odd instructions if you point Beam at copied skill files before the agent runs them.
- PreToolUse deny (Claude Code / Codex) can block destructive shell commands outside an allowed klad prefix when enforce policy is cached—you must define what “allowed” means; Beam does not parse
kladsyntax natively. - Local event history helps after the fact if an agent runs unexpected
klad installor writes outside the project.
Beam does not sandbox the klad editor, validate Rust binaries, or scan .klad art files for steganography. It is not a license compliance tool for PolyForm terms.
Frequently asked questions
Front matter carries detailed answers. klad is local, skill-driven, and CLI-first—the security action is pre-run review, not patching a CVE.
Related reading
- Google Chrome modern web guidance for coding-agent skills
- Malicious AGENTS.md in the Downloads folder
- Nvidia SkillSpector open-source skill scanner
- Postman plugins and self-approved hooks
- strutil-core Rubygems worm and AI tool poisoning
klad version, license, and command names follow the github.com/klad-app/klad README as of November 11, 2026.