Woo Guard You are reviewing generated or changed WooCommerce code before it ships. Apply the rules below as a guard pass after the first implementation pass. WooCommerce is a moving platform — order storage changed engines, checkout changed frameworks — and code written from memory targets the WooCommerce of three years ago. With money on the line, "works on my demo store" is not a standard. These rules exist because AI agents produce WooCommerce code with systematic failures: order meta read through (broken on HPOS stores), products updated by direct meta writes that skip lookup tables and h…

. $amount` fails on the other 150 currencies.\n- Totals and tax: use order/cart getters (`get_total()`, `get_subtotal()`, `WC_Tax` methods) — they apply the store's rounding mode. Re-deriving totals with raw float math produces penny drift that accountants will find.\n- Comparisons: compare formatted decimals or integer minor units; never `==` on floats.\n- Refund/discount logic: negative amounts have meaning — test the zero and partial cases explicitly (test-guard says hi).\n\n## Gateway and webhook callbacks\n\n- Verify webhook signatures/secrets before touching any order; fail closed with the provider's expected status code.\n- Look up orders from gateway references via `wc_get_orders( array( 'transaction_id' => … ) )` or stored CRUD meta — not custom SQL.\n- Callbacks run unauthenticated by design: capability checks don't apply, signature verification is the authentication, and every input is still unslashed and sanitized before use.\n- Idempotency: providers retry. Processing the same payment event twice must not complete an order twice.\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":3538,"content_sha256":"757219b0d5e04f41d4d1141e2659cc9d7293287936603030de6705d09e652516"},{"filename":"references/hpos-and-crud.md","content":"# Woo Guard — HPOS and CRUD Reference\n\n## Contents\n\n- Why HPOS breaks legacy code\n- Order access patterns\n- Order meta done right\n- Products, stock, and lookup tables\n- Status transitions\n- Declaring compatibility\n- Violation table for review\n\n## Why HPOS breaks legacy code\n\nHigh-Performance Order Storage moved orders out of `wp_posts`/`wp_postmeta` into dedicated tables, and it is the default on new stores. Code that treats orders as posts returns empty results or stale data on HPOS stores — silently, with no error. Code written \"from memory\" almost always targets the legacy storage, because that is what most training-era tutorials show.\n\n## Order access patterns\n\n```php\n// Wrong — assumes orders are posts. Fails on HPOS.\n$total = get_post_meta( $order_id, '_order_total', true );\n$orders = get_posts( array( 'post_type' => 'shop_order', 'numberposts' => 20 ) );\n\n// Right — storage-agnostic CRUD API.\n$order = wc_get_order( $order_id );\n$total = $order ? $order->get_total() : 0;\n$orders = wc_get_orders( array( 'status' => 'wc-processing', 'limit' => 20 ) );\n```\n\n`wc_get_orders()` takes its own argument schema (not `WP_Query` args): `limit`, `status`, `customer_id`, `date_created`, `meta_query` equivalents via `field_query`. Never run an unbounded order query — always set a `limit` (wp-guard covers query discipline in depth when installed).\n\n## Order meta done right\n\n```php\n$order = wc_get_order( $order_id );\n$order->update_meta_data( '_ncs_sync_status', 'queued' );\n$order->save(); // persists to whichever storage backend is active\n\n$value = $order->get_meta( '_ncs_sync_status' ); // single value, unserialized\n```\n\n`save()` is not optional — without it, meta changes exist only in memory. Batched changes: set everything, save once.\n\n## Products, stock, and lookup tables\n\nProduct meta writes through `update_post_meta()` skip `wc_product_meta_lookup` sync, skip `woocommerce_update_product`-family hooks, and skip cache invalidation — three classes of bugs other plugins will blame on you.\n\n```php\n$product = wc_get_product( $product_id );\n$product->set_stock_quantity( $new_qty );\n$product->set_regular_price( wc_format_decimal( $price ) );\n$product->save();\n```\n\nStock specifically: `wc_update_product_stock()` and the CRUD setters handle backorders, stock status flips, and concurrency better than any hand-rolled meta math. Direct increments via meta are race-prone on busy stores.\n\n## Status transitions\n\n```php\n$order->update_status( 'completed', 'Synced to fulfillment.' ); // fires emails + hooks\n```\n\nNever set status by writing meta or post fields — `update_status()` triggers the `woocommerce_order_status_*` hooks and customer emails the rest of the store depends on. If suppressing side effects is the goal, that is a design discussion to surface, not a meta write to sneak in.\n\n## Declaring compatibility\n\n```php\nadd_action( 'before_woocommerce_init', function () {\n\tif ( class_exists( \\Automattic\\WooCommerce\\Utilities\\FeaturesUtil::class ) ) {\n\t\t\\Automattic\\WooCommerce\\Utilities\\FeaturesUtil::declare_compatibility( 'custom_order_tables', __FILE__, true );\n\t\t\\Automattic\\WooCommerce\\Utilities\\FeaturesUtil::declare_compatibility( 'cart_checkout_blocks', __FILE__, true );\n\t}\n} );\n```\n\nDeclare only what is true — a false `custom_order_tables` declaration on postmeta-reading code converts a visible warning into an invisible data bug.\n\n## Violation table for review\n\n| Grep hit | Why it fails |\n|---|---|\n| `get_post_meta( $order_id` | HPOS: order meta is not postmeta |\n| `post_type => 'shop_order'` (or `shop_order_refund`) | HPOS: orders are not posts |\n| `update_post_meta( $product_id` | Skips lookup tables, hooks, caches |\n| `wp_update_post` on order/product IDs | Same class of bypass |\n| `$wpdb` joins on `postmeta` for order data | HPOS + fragile schema coupling |\n| `posts_per_page => -1` over products/orders | Unbounded query, store-sized blast radius |\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":3931,"content_sha256":"d696eb4741a5b072382decc89a753eb7b9e7a92653a4aba8e7a33bb1439bc313"},{"filename":"references/review-checklist.md","content":"# Woo Guard — Review Checklist\n\nStructured walk for review mode. First sweep the security floor on the same files — output escaping, unslash-then-sanitize on request data, capability plus nonce on state changes, prepared queries — money code gets zero security slack (wp-guard covers the full WordPress layer when installed). Cite file:line.\n\n## Contents\n\n- Pass 1: HPOS and CRUD greps\n- Pass 2: Checkout and money\n- Pass 3: Runtime context\n- Pass 4: Compatibility and packaging\n- Reporting\n\n## Pass 1: HPOS and CRUD greps (must fix)\n\nRun the violation table in [hpos-and-crud.md](hpos-and-crud.md):\n\n- `get_post_meta` / `update_post_meta` / `wp_update_post` touching order or product IDs\n- `post_type => 'shop_order'` in any query; `$wpdb` joins on postmeta for order data\n- Meta changes without a following `save()`\n- Stock or order status set by meta/post-field writes instead of `wc_update_product_stock()` / `$order->update_status()`\n- Unbounded `wc_get_orders()` / product queries (no `limit`)\n\n## Pass 2: Checkout and money (must fix)\n\n- Checkout rules enforced server-side (`woocommerce_checkout_process` or Store API schema)? JS-only validation is a finding.\n- Which checkout does the code target — and does that match what it claims to support?\n- Money: `wc_format_decimal()` on inputs, `wc_price()` on display, store rounding on totals; flag float arithmetic, `number_format()`, hardcoded symbols, float `==`.\n- Webhook/gateway callbacks: signature verified before order access? Idempotent on retries?\n\n## Pass 3: Runtime context (should fix)\n\n- `WC()->cart` / `WC()->session` / `WC()->customer` reachable from REST, cron, CLI, or webhooks without guards?\n- `woocommerce_*` hooks and `wc_*` functions verified to exist in the supported version range?\n- WooCommerce-active checks before hooking (`class_exists` / feature checks)?\n\n## Pass 4: Compatibility and packaging (should fix)\n\n- `FeaturesUtil` declarations present and truthful (`custom_order_tables`, `cart_checkout_blocks`)?\n- Template overrides shipped inside the plugin? (Always a finding — hooks or `woocommerce_locate_template`.)\n- Background/batch work on Action Scheduler, idempotent handlers?\n\n## Reporting\n\nUse the SKILL.md format (What / Risk / Fix). Lead with Pass 1–2 findings and an overall verdict (merge / fix first / do not merge). Note explicitly when security-floor findings exist on the same files so the user sees the full bill at once.\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":2437,"content_sha256":"8b492aaf0a59370ad5da1122c6bdf1ca61fab937d4770f5fbeb9730ed2a7ab9e"},{"filename":"references/sources.md","content":"# Woo Guard — Sources\n\nCentral bibliography. Operational guidance lives in the other references; read this file only when a source URL is needed.\n\n## Contents\n\n- WooCommerce developer documentation\n\n## WooCommerce developer documentation\n\n- HPOS (High-Performance Order Storage): https://developer.woocommerce.com/docs/features/high-performance-order-storage/\n- HPOS recipe book (compatibility patterns): https://developer.woocommerce.com/docs/features/high-performance-order-storage/recipe-book/\n- CRUD objects: https://developer.woocommerce.com/docs/category/data-management/crud-objects/\n- Store API: https://developer.woocommerce.com/docs/apis/store-api/\n- Cart and Checkout Blocks — extensibility: https://developer.woocommerce.com/docs/category/cart-and-checkout-blocks/\n- Action Scheduler: https://actionscheduler.org/\n- Payment gateway API: https://developer.woocommerce.com/docs/woocommerce-payment-gateway-api/\n","content_type":"text/markdown; charset=utf-8","language":"markdown","size":925,"content_sha256":"e0a0326bf08b910f68a06e820ffdbb4dcfe23a91be4757430322be92e9e98888"}],"content_json":{"type":"doc","content":[{"type":"heading","attrs":{"level":1},"content":[{"text":"Woo Guard","type":"text"}]},{"type":"paragraph","content":[{"text":"You are reviewing generated or changed WooCommerce code before it ships. Apply the rules below as a guard pass after the first implementation pass. WooCommerce is a moving platform — order storage changed engines, checkout changed frameworks — and code written from memory targets the WooCommerce of three years ago. With money on the line, \"works on my demo store\" is not a standard.","type":"text"}]},{"type":"paragraph","content":[{"text":"These rules exist because AI agents produce WooCommerce code with systematic failures: order meta read through ","type":"text"},{"text":"get_post_meta()","type":"text","marks":[{"type":"code_inline"}]},{"text":" (broken on HPOS stores), products updated by direct meta writes that skip lookup tables and hooks, checkout validated only in JavaScript, prices computed in floats, and ","type":"text"},{"text":"woocommerce_*","type":"text","marks":[{"type":"code_inline"}]},{"text":" hooks registered before confirming WooCommerce is active.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"How to use this skill","type":"text"}]},{"type":"paragraph","content":[{"text":"Guard-pass mode","type":"text","marks":[{"type":"strong"}]},{"text":" (recommended): after WooCommerce code has been generated or edited, apply the rules to the diff or target files, then run the self-check before delivery.","type":"text"}]},{"type":"paragraph","content":[{"text":"Live mode","type":"text","marks":[{"type":"strong"}]},{"text":" (explicit): when the user invokes this skill before writing WooCommerce code, apply the same rules while writing, then run the self-check before delivery.","type":"text"}]},{"type":"paragraph","content":[{"text":"Review mode","type":"text","marks":[{"type":"strong"}]},{"text":" (the user asks you to review or audit WooCommerce code): walk ","type":"text"},{"text":"references/review-checklist.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/review-checklist.md","title":null}}]},{"text":" and produce a structured findings report. Do not edit code in review mode unless asked.","type":"text"}]},{"type":"paragraph","content":[{"text":"Security floor","type":"text","marks":[{"type":"strong"}]},{"text":" — these hold in all WooCommerce code, at maximum severity, because money is on the line:","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Escape all output with the context-correct ","type":"text"},{"text":"esc_*","type":"text","marks":[{"type":"code_inline"}]},{"text":" function.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"wp_unslash()","type":"text","marks":[{"type":"code_inline"}]},{"text":" then sanitize all request data before it touches logic.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Capability check plus nonce on every state change.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"$wpdb->prepare()","type":"text","marks":[{"type":"code_inline"}]},{"text":" for every query containing a variable.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"If wp-guard is installed, run it alongside for the full WordPress layer.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Adapt to the project first","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Read the project's agent instructions and the extension's declared WooCommerce version range. Project conventions win on conflict.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Determine the order storage mode this code must support: HPOS, legacy posts, or both (the default assumption is both).","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Determine the checkout in play: Blocks/Store API, legacy shortcode checkout, or both. Hooks for one do not fire in the other.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Check whether WooCommerce activity is guarded: feature checks or ","type":"text"},{"text":"class_exists( 'WooCommerce' )","type":"text","marks":[{"type":"code_inline"}]},{"text":" before any ","type":"text"},{"text":"wc_*","type":"text","marks":[{"type":"code_inline"}]},{"text":" call or ","type":"text"},{"text":"woocommerce_*","type":"text","marks":[{"type":"code_inline"}]},{"text":" hook.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"The Rules","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Order and product data — must fix","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Orders are not posts.","type":"text","marks":[{"type":"strong"}]},{"text":" Access orders only through the CRUD API: ","type":"text"},{"text":"wc_get_order()","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"wc_get_orders()","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"$order->get_meta()","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"$order->update_meta_data()","type":"text","marks":[{"type":"code_inline"}]},{"text":" + ","type":"text"},{"text":"$order->save()","type":"text","marks":[{"type":"code_inline"}]},{"text":". Forbidden on order data: ","type":"text"},{"text":"get_post_meta()","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"update_post_meta()","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"WP_Query","type":"text","marks":[{"type":"code_inline"}]},{"text":"/","type":"text"},{"text":"get_posts()","type":"text","marks":[{"type":"code_inline"}]},{"text":" with ","type":"text"},{"text":"post_type => shop_order","type":"text","marks":[{"type":"code_inline"}]},{"text":", and direct ","type":"text"},{"text":"$wpdb","type":"text","marks":[{"type":"code_inline"}]},{"text":" joins on postmeta. These work on legacy stores and silently break on HPOS stores. Details: ","type":"text"},{"text":"references/hpos-and-crud.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/hpos-and-crud.md","title":null}}]},{"text":".","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"CRUD objects, getters/setters, then save.","type":"text","marks":[{"type":"strong"}]},{"text":" Products, customers, and coupons go through their CRUD objects (","type":"text"},{"text":"wc_get_product()","type":"text","marks":[{"type":"code_inline"}]},{"text":", setters, ","type":"text"},{"text":"->save()","type":"text","marks":[{"type":"code_inline"}]},{"text":"). Direct meta writes skip lookup-table sync, skip the hooks other extensions rely on, and skip cache invalidation. Stock changes go through ","type":"text"},{"text":"wc_update_product_stock()","type":"text","marks":[{"type":"code_inline"}]},{"text":" semantics; order state changes through ","type":"text"},{"text":"$order->update_status()","type":"text","marks":[{"type":"code_inline"}]},{"text":" — which fire the emails and hooks the store expects.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Declare feature compatibility.","type":"text","marks":[{"type":"strong"}]},{"text":" Any extension touching orders declares HPOS compatibility (","type":"text"},{"text":"FeaturesUtil::declare_compatibility( 'custom_order_tables', … )","type":"text","marks":[{"type":"code_inline"}]},{"text":"); any extension touching checkout declares ","type":"text"},{"text":"cart_checkout_blocks","type":"text","marks":[{"type":"code_inline"}]},{"text":" compatibility (or incompatibility, honestly). A missing declaration shows every store owner a warning banner with your plugin's name on it.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Checkout and money — must fix","type":"text"}]},{"type":"ordered_list","attrs":{"order":4,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Checkout validation is server-side.","type":"text","marks":[{"type":"strong"}]},{"text":" Validate at ","type":"text"},{"text":"woocommerce_checkout_process","type":"text","marks":[{"type":"code_inline"}]},{"text":" (legacy) or through Store API extension schemas (Blocks). JavaScript validation is UX, never security. Know which checkout the store runs and wire both when the extension claims general compatibility.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Money is not a float.","type":"text","marks":[{"type":"strong"}]},{"text":" Prices and totals go through ","type":"text"},{"text":"wc_format_decimal()","type":"text","marks":[{"type":"code_inline"}]},{"text":" for storage-safe values, ","type":"text"},{"text":"wc_price()","type":"text","marks":[{"type":"code_inline"}]},{"text":" for display, and WooCommerce's own tax/rounding settings for arithmetic. No hand-rolled currency symbols, no ","type":"text"},{"text":"number_format()","type":"text","marks":[{"type":"code_inline"}]},{"text":" on prices, no float equality on totals.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Runtime discipline — should fix","type":"text"}]},{"type":"ordered_list","attrs":{"order":6,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Guard the runtime context.","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"WC()->cart","type":"text","marks":[{"type":"code_inline"}]},{"text":" and ","type":"text"},{"text":"WC()->session","type":"text","marks":[{"type":"code_inline"}]},{"text":" are null in REST, cron, CLI, and admin contexts — check before touching them. Never assume a logged-in customer in webhook or gateway callbacks. Verify every ","type":"text"},{"text":"woocommerce_*","type":"text","marks":[{"type":"code_inline"}]},{"text":" hook and ","type":"text"},{"text":"wc_*","type":"text","marks":[{"type":"code_inline"}]},{"text":" function exists in the supported version range — WooCommerce renames and retires hooks across majors.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Hooks over template overrides.","type":"text","marks":[{"type":"strong"}]},{"text":" Prefer, in order: existing WooCommerce hooks/filters → the ","type":"text"},{"text":"woocommerce_locate_template","type":"text","marks":[{"type":"code_inline"}]},{"text":" filter → a theme-level override. A template override shipped inside a plugin freezes a copied file at one WooCommerce version and breaks on template updates — flag it in review, always.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Background work scales with order volume.","type":"text","marks":[{"type":"strong"}]},{"text":" Batch jobs, syncs, and webhook fan-out go through Action Scheduler (bundled with WooCommerce), not raw WP-Cron loops. Handlers are idempotent — order events fire more than once in real stores.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Self-check before delivery","type":"text"}]},{"type":"ordered_list","attrs":{"order":1,"listStyle":"number"},"content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Grep your diff for ","type":"text"},{"text":"get_post_meta","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"update_post_meta","type":"text","marks":[{"type":"code_inline"}]},{"text":", ","type":"text"},{"text":"post_type => 'shop_order'","type":"text","marks":[{"type":"code_inline"}]},{"text":": any of them touching orders? (Rule 1)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Any product/order/customer write that bypasses a CRUD object's ","type":"text"},{"text":"save()","type":"text","marks":[{"type":"code_inline"}]},{"text":"? (Rule 2)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Does the extension declare HPOS (and checkout-blocks, if relevant) compatibility? (Rule 3)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Is every checkout rule enforced server-side, for the checkout(s) the store actually runs? (Rule 4)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Any float arithmetic, hardcoded currency symbol, or ","type":"text"},{"text":"number_format()","type":"text","marks":[{"type":"code_inline"}]},{"text":" on money? (Rule 5)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Any ","type":"text"},{"text":"WC()->cart","type":"text","marks":[{"type":"code_inline"}]},{"text":"/","type":"text"},{"text":"WC()->session","type":"text","marks":[{"type":"code_inline"}]},{"text":" access that can run in REST/cron/CLI? Any unverified hook name? (Rule 6)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Any template file shipped in the plugin? (Rule 7)","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Security floor: every output escaped, every request input unslashed then sanitized, every state change capability-checked and nonce-verified, every variable query prepared?","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"If any answer is wrong, fix it before showing the user.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reporting format (review mode)","type":"text"}]},{"type":"code_block","attrs":{"wrap":false,"language":""},"content":[{"text":"**Rule N violation** in `path/file.php:\u003cline or function>`\n- What: \u003cone sentence>\n- Risk: \u003cHPOS breakage / skipped hooks / money error / checkout bypass — one phrase>\n- Fix: \u003cone sentence>","type":"text"}]},{"type":"paragraph","content":[{"text":"Group by file, lead with Rules 1–5 findings. If a file is clean, don't mention it.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Severity guide","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Must fix:","type":"text","marks":[{"type":"strong"}]},{"text":" Rules 1–5 — broken stores, skipped business logic, wrong money","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Should fix:","type":"text","marks":[{"type":"strong"}]},{"text":" Rules 6–8 — context crashes, update fragility, jobs that die at scale","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"References","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/hpos-and-crud.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/hpos-and-crud.md","title":null}}]},{"text":" — HPOS background, CRUD patterns, compatibility declaration, violation table","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/checkout-and-money.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/checkout-and-money.md","title":null}}]},{"text":" — legacy vs Blocks checkout, Store API validation, price and currency handling","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/review-checklist.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/review-checklist.md","title":null}}]},{"text":" — structured walk-through for review mode","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"references/sources.md","type":"text","marks":[{"type":"link","attrs":{"href":"references/sources.md","title":null}}]},{"text":" — WooCommerce developer documentation URLs; read only when citing","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"What this skill does not do","type":"text"}]},{"type":"bullet_list","content":[{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Cover the full WordPress layer beyond the security floor — i18n and asset/query discipline are wp-guard's jurisdiction when it is installed.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Review store configuration, theme styling, or payment provider account setup.","type":"text"}]}]},{"type":"list_item","content":[{"type":"paragraph","content":[{"text":"Decide pricing or business logic — it guards how WooCommerce code ships, not what the store sells.","type":"text"}]}]}]}]},"metadata":{"date":"2026-11-02","name":"woo-guard","author":"@skillopedia","source":{"stars":1304,"repo_name":"guard-skills","origin_url":"https://github.com/amElnagdy/guard-skills/blob/HEAD/skills/woo-guard/SKILL.md","repo_owner":"amElnagdy","body_sha256":"399153179c0784bbffe5f4d9a8bd388178c80d6e754fcc6e5e5c6f23e01efc45","cluster_key":"0d1c4e06ed9584ae33ac9db80d2977a0ccb74f6acbe7bfef95b6fb6fc894e731","clean_bundle":{"format":"clean-skill-bundle-v1","source":"amElnagdy/guard-skills/skills/woo-guard/SKILL.md","text_bytes":11081,"source_commit":"ffa26036b7b5e77b20b5d679304a703b6fd1a43d","skills_sh_rank":7378,"attachment_count":5,"text_attachments":5,"attachment_storage":"skill_attachments","binary_attachments":0},"cluster_size":1,"skill_md_path":"skills/woo-guard/SKILL.md","import_metadata":{"date":"2026-11-02","author":"@skillopedia","version":"v1","category":"software-engineering","category_label":"Engineering"},"exact_dupes_collapsed_into_this":0},"version":"v1","category":"software-engineering","import_tag":"skills-sh-top20k-2026-11","description":"Review generated or changed WooCommerce code — extensions, payment and shipping integrations, checkout customizations, and order/product logic — before it ships. Best used reactively after an agent writes, edits, or reviews code touching WooCommerce APIs: wc_get_order, wc_get_orders, wc_get_product, WC() cart or session, woocommerce_* hooks, Store API endpoints, payment gateways, order or product meta, HPOS, subscriptions, or bookings. Use on 'review this Woo plugin', 'is this HPOS compatible', or after tasks like 'write a WooCommerce extension', 'add a checkout field', 'hook into the order flow', or 'update stock'. Enforces HPOS-safe order access, CRUD over direct meta, feature-compatibility declarations, server-side checkout validation, money-handling discipline, and hooks over template overrides. DO NOT USE for WordPress code without WooCommerce APIs (use wp-guard), generic code review (use clean-code-guard), test review (use test-guard), or store configuration and admin-screen questions."}},"renderedAt":1793671708644}

Woo Guard You are reviewing generated or changed WooCommerce code before it ships. Apply the rules below as a guard pass after the first implementation pass. WooCommerce is a moving platform — order storage changed engines, checkout changed frameworks — and code written from memory targets the WooCommerce of three years ago. With money on the line, "works on my demo store" is not a standard. These rules exist because AI agents produce WooCommerce code with systematic failures: order meta read through (broken on HPOS stores), products updated by direct meta writes that skip lookup tables and h…