# Woo Guard

Review generated or changed WooCommerce code, extensions, payment and shipping...

- Repository: https://github.com/amElnagdy/guard-skills (1302 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-07-04
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add amElnagdy/guard-skills --skill woo-guard -g -a claude-code -y`
Codex: `npx skills add amElnagdy/guard-skills --skill woo-guard -g -a codex -y`
Cursor: `npx skills add amElnagdy/guard-skills --skill woo-guard -g -a cursor -y`
Gemini CLI: `npx skills add amElnagdy/guard-skills --skill woo-guard -g -a gemini-cli -y`

## Description

Review generated or changed WooCommerce code, extensions, payment and shipping integrations, checkout customizations, and order/product logic, before it ships. Best used reactively after an agent writes, edits, or reviews code touching WooCommerce APIs: wc_get_order, wc_get_orders, wc_get_product, WC() cart or session, woocommerce_* hooks, Store API endpoints, payment gateways, order or product meta, HPOS, subscriptions, or bookings. Use on 'review this Woo plugin', 'is this HPOS compatible', or after tasks like 'write a WooCommerce extension', 'add a checkout field', 'hook into the order flow', or 'update stock'. Enforces HPOS-safe order access, CRUD over direct meta, feature-compatibility declarations, server-side checkout validation, money-handling discipline, and hooks over template overrides. DO NOT USE for WordPress code without WooCommerce APIs (use wp-guard), generic code review (use clean-code-guard), test review (use test-guard), or store configuration and admin-screen questions.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Woo Guard

You are reviewing generated or changed WooCommerce code before it ships. Apply the rules below as a guard pass after the first implementation pass. WooCommerce is a moving platform, order storage changed engines, checkout changed frameworks, and code written from memory targets the WooCommerce of three years ago. With money on the line, "works on my demo store" is not a standard.

These rules exist because AI agents produce WooCommerce code with systematic failures: order meta read through `get_post_meta()` (broken on HPOS stores), products updated by direct meta writes that skip lookup tables and hooks, checkout validated only in JavaScript, prices computed in floats, and `woocommerce_*` hooks registered before confirming WooCommerce is active.

## How to use this skill

**Guard-pass mode** (recommended): after WooCommerce code has been generated or edited, apply the rules to the diff or target files, then run the self-check before delivery.

**Live mode** (explicit): when the user invokes this skill before writing WooCommerce code, apply the same rules while writing, then run the self-check before delivery.

**Review mode** (the user asks you to review or audit WooCommerce code): walk [references/review-checklist.md](references/review-checklist.md) and produce a structured findings report. Do not edit code in review mode unless asked.

**Security floor**, these hold in all WooCommerce code, at maximum severity, because money is on the line:

- Escape all output with the context-correct `esc_*` function.
- `wp_unslash()` then sanitize all request data before it touches logic.
- Capability check plus nonce on every state change.
- `$wpdb->prepare()` for every query containing a variable.

If wp-guard is installed, run it alongside for the full WordPress layer.

## Adapt to the project first

The rest: https://github.com/amElnagdy/guard-skills/blob/HEAD/skills/woo-guard/SKILL.md