Payload is an open-source, full-stack framework for Next.js that provides a TypeScript backend and an administration panel for managing application data and content. Developers use it as a headless content management system or as the backend and application framework for their own projects. The catalogue add-ons help agents work with Payload projects and their development workflows.
Borrowing it
Nothing to install: this file belongs to payloadcms/payload. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/payloadcms/payload/main/.agents/skills/ui4-convert-tests/SKILL.mdgit clone --depth 1 https://github.com/payloadcms/payloadWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/payloadcms/payload/ui4-convert-tests)<a href="https://agentmods.dev/skills/payloadcms/payload/ui4-convert-tests"><img src="https://agentmods.dev/badge/skills/payloadcms/payload/ui4-convert-tests/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/payloadcms/payload/ui4-convert-tests"><img src="https://agentmods.dev/badge/skills/payloadcms/payload/ui4-convert-tests.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Snyk fail
- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 46 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 210 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 213 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.03414 |
| Opus 5.5 | $0.00014 | $0.01366 |
| Sonnet 5.5 | $0.00007 | $0.00683 |
| Haiku 4.5 | $0.00004 | $0.00341 |
Grade A, and why
ui4-convert-tests scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 453 lines — stays where its author put it; the contents beside it link to each section on GitHub.
UI4 Convert Tests
Overview
After completing UI changes, this skill systematically identifies and fixes affected e2e tests. It analyzes the diff to understand what kind of changes were made (not just which files), then finds tests that need updates.
When to Use
- UI changes are finalized and ready for test fixes
- CI is failing on tests due to your UI changes
- Before opening a PR to ensure tests pass
Process
Step 1: Analyze What Changed
Goal: Understand the nature of your changes to predict test impact.
# Get changed UI files
git diff main --name-only -- 'packages/ui/src/**/*.tsx' 'packages/ui/src/**/*.css'
For each changed file, categorize the changes:
A. Selector Changes (IDs, classes)
git diff main -- <file> | grep -E '^\-.*className|^\-.*id=|^\+.*className|^\+.*id='
B. Structural Changes (elements moved)
Look for components being:
- Moved INTO a popup, drawer, or dropdown
- Wrapped in new parent elements
- Made conditional
git diff main -- <file> | grep -E 'Popup|PopupList|Drawer|Dropdown'
C. Text/Label Changes
# Translation keys
git diff main -- <file> | grep -E "t\('|i18n\.t\("
# Hardcoded text
git diff main -- <file> | grep -E 'placeholder=|aria-label='
Build a change summary:
| Change Type | What Changed | Test Impact |
|---|---|---|
| Selector | .btn:has-text("Create") → #create-new-doc |
Update locators |
| Structure | Button moved into popup | Add popup open step |
| Text | "Search by ID" → "Search" | Update assertions |
Step 2: Find Affected Tests
Search strategy: Cast a wide net, then narrow down.
# Search for component name references (not just selectors)
grep -rn "QueryPreset\|query-preset\|preset" test/**/*.ts --include="*.spec.ts" --include="*.ts"
# Search for specific selectors from Step 1
grep -rn "\.list-header\|Create New\|#create-new" test/**/*.ts
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 453 lines · 36 tokens per session scan A 547ea3c63c8d
ui4-convert-tests is a skill published in the GitHub repository payloadcms/payload (45,565 stars, last pushed today), licensed MIT. It adds 36 tokens to every session and 3,414 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
next-cache-components-optimizer
Optimize the meaningful UI available immediately from a Next.js route on an initial load (hard navigation) or named client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route and entry point at a time; the shipped test then guards…
next-partial-prefetching-optimizer
Optimize what selected Next.js client navigations include before the click under Partial Prefetching. Use after Cache Components and Partial Prefetching are adopted when the user wants selected URL-specific UI to be instant, wants reusable content to wait for navigation, or needs to choose between default, viewport…
ux-acceptance-coordinator
Coordinate black-box, agent-driven UX acceptance journeys against a disposable EmDash admin site. Use when preparing, dispatching, verifying, or reporting a manual browser journey performed by a separate tester agent. Do not use for deterministic Playwright tests or ordinary code review.
ux-acceptance-tester
Perform a goal-driven, black-box UX acceptance journey in a browser and report the path, friction, and observable outcome. Use only in an isolated tester context with a supplied start URL and brief.
verify
Build/launch/drive recipe for verifying apps/docs changes at runtime (demos, docs pages, llms.txt).
verify-bug
Post-merge UAT verification workflow. Walks JIRA reproduce steps, performs comparative audits (Before/After), attaches evidence to JIRA, and transitions status on PASS.