Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/textura-agency/next16-claude-starternpx agentmods add skills/textura-agency/next16-claude-starter/payload-cmsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/textura-agency/next16-claude-starter/payload-cms)<a href="https://agentmods.dev/skills/textura-agency/next16-claude-starter/payload-cms"><img src="https://agentmods.dev/badge/skills/textura-agency/next16-claude-starter/payload-cms/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/textura-agency/next16-claude-starter/payload-cms"><img src="https://agentmods.dev/badge/skills/textura-agency/next16-claude-starter/payload-cms.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 14 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00216 | $0.04474 |
| Opus 5.5 | $0.00086 | $0.01790 |
| Sonnet 5.5 | $0.00043 | $0.00895 |
| Haiku 4.5 | $0.00022 | $0.00447 |
Grade A, and why
payload-cms scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 219 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Payload CMS — the admin flow
This is the flow a production site went through to get an admin its owner
called "great": every word on the site editable, grouped the way the site
reads, SEO per page with a live link preview, light consented analytics, the
site's own look, and a guide with screenshots inside the admin. It is written
down as kits (templates/) and decisions (below) so the next site gets there in
one pass instead of twenty requests.
Read first: obsidian/workflows/cms-admin.md (the flow at a glance) and
obsidian/backend/cms-payload.md (the architecture). Verified against
Payload 3.89 · Next 16.3 · Node 24 (2026-10).
The decisions — and why
Every one of these was a request or a defect on the reference site. Don't undo one without the reason in front of you.
| # | Decision | Why |
|---|---|---|
| D1 | Payload inside the app — app/(payload) + app/(site), one build, one deploy |
The owner asked for one project. Local API reads in process — no HTTP hop, works at build time. |
| D2 | Fields are derived from the content objects (text-schema.ts walks src/data/mocks/*), not hand-written |
Every string becomes a field defaulted to today's copy; a new line in code is a new field next deploy. Hand-written schemas drift and miss copy. |
| D3 | Reading is a merge: getText("hero") returns the code's HERO with the admin's strings laid over it — same type |
Views and components stay untouched. A deliberate exception to "use the generated type in the view" (rule payload.md). |
| D4 | Blank / missing / DB down → the code's copy, error logged | The site never goes blank because the CMS did. A fresh database renders the full site. |
| D5 | Globals, not collections or blocks, for a marketing page's sections | Each section exists once; its order is choreographed with motion/scene, so it is not the editor's to reorder. Collections only for things that are many (posts, cases). Blocks only when the editor genuinely composes pages. |
| D6 | Wiring is skipped (SKIP: id, href, anchors, textures, scene data…); card lists have fixed rows matched by a hidden key |
The editor rewrites a card but cannot break the layout, cross-wire a card to another's image, or add a 7th card to a 6-slot ring. |
| D7 | OPEN_LISTS with a floor/ceiling for lists the layout can resize; an added row must fill every line + photo |
The client asked to change counts; the floor is what keeps a carousel from showing empty glass. |
| D8 | Photos are optional uploads beside their copy ("Replace photo"): blank → photo in code; upload → its URL, alt, a 512 px small size for textures, crop dropped |
Same fallback rule as text. Only content photos — decorative art and the scene stay in code. |
| D9 | One SEO global, a tab per page + Site defaults; parity with everything <head>, JSON-LD and sitemap.xml emit; a link-preview card per tab |
"SEO for each page, the same as the site has it." Titles are absolute (Brand | …, 50–60 chars) and written for search; the plugin's fields are placed by hand because routes are fixed. |
| D10 | Share image seeded into Media on onInit (idempotent, never throws) |
The editor sees the real card in the admin and can replace it, instead of a hint about a file in the code. |
| D11 | Routes stay static; every global's afterChange → revalidatePath("/", "layout") |
Hard rule #15 holds; saves still show at once. |
| D12 | Migrations only, push: false everywhere; yarn migrate:direct over the session pooler |
The same steps on every machine and the host. push against a live DB is how schemas get rewritten. |
| D13 | Storage plugin always registered (enabled from env, alwaysInsertFields), files linked from the public bucket URL |
The schema — and so the migrations — never depend on whether a laptop has S3 keys. next/image and WebGL loaders fetch from Supabase's CDN, not through /api/media/file. |
| D14 | English admin, labels in the editor's words, sidebar groups in reading order, row labels from the row's own copy | An admin that reads like the site is one an owner uses. |
| D15 | Every legal section is one rich-text field (bold, links, lists, h3; table/button as blocks) | Asked for after a block-per-paragraph model: an editor could not bold a word or link inside a sentence. Start with rich text. |
| D16 | /admin and /api/ disallowed in robots.ts; /llms.txt from the SEO global; sitemap lastmod = the globals' updatedAt |
SEO audit findings: a login screen in the crawl budget, request-time lastmod (ignored), no llms.txt. |
| D17 | Things that are many (posts, locations, services) are collections with their own routes — the blog / collection kits — each page indexed only when it clears a bar, an old slug answering 308 |
Blogs and page sets are where sites win long-tail search, and where thin, templated or orphaned pages lose it. |
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/blog.md 5.4 KB
- references/collection-pages.md 4.9 KB
- references/content-model.md 4.5 KB
- references/legal-rich-text.md 2.5 KB
- references/seo-global.md 3.6 KB
- references/supabase-wiring.md 4.6 KB
- scaffold.sh 2.9 KB runs code
- templates/admin/src/app/(payload)/custom.css.tmpl 27 KB
- templates/admin/src/cms/admin/graphics.tsx.tmpl 1.3 KB
- templates/admin/src/cms/admin/row-label.tsx.tmpl 1.3 KB
- templates/admin/src/cms/admin/welcome.tsx.tmpl 1.4 KB
- templates/analytics/src/app/api/track/route.ts.tmpl 2.3 KB
- templates/analytics/src/cms/admin/analytics-card.tsx.tmpl 736 B
- templates/analytics/src/cms/admin/analytics-chart.tsx.tmpl 5.4 KB
- templates/analytics/src/cms/admin/analytics-nav.tsx.tmpl 643 B
- templates/analytics/src/cms/admin/analytics-ui.tsx.tmpl 4.7 KB
- templates/analytics/src/cms/admin/analytics-view.tsx.tmpl 3.4 KB
- templates/analytics/src/cms/admin/format.ts.tmpl 579 B
- templates/analytics/src/cms/analytics.ts.tmpl 11 KB
- templates/analytics/src/cms/collections/page-views.ts.tmpl 1.8 KB
- templates/analytics/src/components/common/analytics-beacon.tsx.tmpl 3.7 KB
- templates/blog/src/app/(site)/blog/[slug]/page.tsx.tmpl 525 B
- templates/blog/src/app/(site)/blog/author/[slug]/page.tsx.tmpl 541 B
- templates/blog/src/app/(site)/blog/feed.xml/route.ts.tmpl 2.1 KB
- templates/blog/src/app/(site)/blog/page.tsx.tmpl 192 B
- templates/blog/src/app/(site)/blog/topic/[slug]/page.tsx.tmpl 533 B
- templates/blog/src/cms/blog.ts.tmpl 13 KB
- templates/blog/src/cms/collections/authors.ts.tmpl 2.0 KB
- templates/blog/src/cms/collections/posts.ts.tmpl 5.5 KB
- templates/blog/src/cms/collections/topics.ts.tmpl 1.6 KB
- templates/blog/src/data/mocks/blog.ts.tmpl 1.0 KB
- templates/blog/src/views/blog/archive.tsx.tmpl 1.9 KB
- templates/blog/src/views/blog/blog-author.tsx.tmpl 2.3 KB
- templates/blog/src/views/blog/blog-index.tsx.tmpl 3.4 KB
- templates/blog/src/views/blog/blog-post.tsx.tmpl 6.6 KB
- templates/blog/src/views/blog/blog-topic.tsx.tmpl 1.6 KB
- templates/blog/src/views/blog/format.ts.tmpl 374 B
- templates/blog/src/views/blog/post-card.tsx.tmpl 1.6 KB
- templates/cms-shared/src/cms/collection-hooks.ts.tmpl 1012 B
- templates/cms-shared/src/cms/docs.ts.tmpl 3.3 KB
- templates/cms-shared/src/cms/fields/search.ts.tmpl 2.4 KB
- templates/cms-shared/src/cms/fields/slug.ts.tmpl 2.9 KB
- templates/cms-shared/src/cms/lexical.ts.tmpl 3.3 KB
- templates/cms-shared/src/components/cms/breadcrumbs.tsx.tmpl 1.4 KB
- templates/cms-shared/src/components/cms/rich-text.tsx.tmpl 3.4 KB
- templates/collection/src/app/(site)/entries/[slug]/page.tsx.tmpl 524 B
- templates/collection/src/app/(site)/entries/page.tsx.tmpl 216 B
- templates/collection/src/cms/collections/entries.ts.tmpl 12 KB
- templates/collection/src/cms/entries-config.ts.tmpl 2.3 KB
- templates/collection/src/cms/entries.ts.tmpl 9.1 KB
- templates/collection/src/data/mocks/entries.ts.tmpl 923 B
- templates/collection/src/views/entries/entries-hub.tsx.tmpl 2.9 KB
- templates/collection/src/views/entries/entry-page.tsx.tmpl 8.2 KB
- templates/core/scripts/migrate-direct.mjs.tmpl 1.4 KB
- templates/core/src/app/(payload)/admin/[[...segments]]/not-found.tsx.tmpl 731 B
- templates/core/src/app/(payload)/admin/[[...segments]]/page.tsx.tmpl 715 B
- templates/core/src/app/(payload)/api/[...slug]/route.ts.tmpl 550 B
- templates/core/src/app/(payload)/api/graphql-playground/route.ts.tmpl 305 B
- templates/core/src/app/(payload)/api/graphql/route.ts.tmpl 315 B
- templates/core/src/app/(payload)/layout.tsx.tmpl 809 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 23d ago Changed · +19 lines · +43 tokens per session b9dab80f557b
- 1mo ago Changed · +2 lines · +72 tokens per session aff829c1eb4c
- 2mo ago First seen · 198 lines · 101 tokens per session scan A 42ed9cb4b018
payload-cms is a skill published in the GitHub repository textura-agency/next16-claude-starter (145 stars, last pushed 23d ago), licensed Unlicense. It adds 216 tokens to every session and 4,474 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
payload-cms compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| payload-cmstextura-agency/next16-claude-starter | Skill | 145 | 23d ago | Unlicense | A | 216 | Claude Code |
| azure-postgres-tsmicrosoft/skills | Skill | 3.2k | yesterday | MIT | A | 94 | Claude Code |
| supabasesupabase/agent-skills | Skill | 3.0k | yesterday | MIT | A | 185 | Claude Code, Codex |
| butterbasebutterbase-ai/butterbase | Skill | 3.0k | yesterday | Apache-2.0 | A | 34 | Claude Code, Codex |
| supabase-clifcakyon/claude-codex-settings | Skill | 1.2k | yesterday | Apache-2.0 | A | 60 | Claude Code |
| supabase-jsfcakyon/claude-codex-settings | Skill | 1.2k | yesterday | Apache-2.0 | A | 64 | Claude Code |
| firebase-data-connectfirebase/agent-skills | Skill | 503 | 2d ago | Apache-2.0 | A | 74 | Claude Code |