New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

WooCommerce Code Guard

by amElnagdy in amElnagdy/guard-skills

Reviews generated or changed WooCommerce code for HPOS safety, CRUD use, checkout validation and money handling before it ships.

MITAuto-check passedDevelopment

Install WooCommerce Code Guard

skills CLI
$ npx skills add amElnagdy/guard-skills --skill woo-guard -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install amElnagdy/guard-skills woo-guard --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/amElnagdy/guard-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/woo-guard .claude/skills/woo-guard && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
woo-guard
GitHub stars
1.3k
Token cost
~2.2k tokens
SKILL.md length
973 words
Files
6 (incl. references)
Skills in repo
5
Repo updated
First seen
Licence
MIT

At a glance

Reviews generated or changed WooCommerce code for HPOS safety, CRUD use, checkout validation and money handling before it ships.

  • Works in 4 steps: Read the project's agent instructions… → Determine the order storage mode this… → Determine the checkout in play:… → …
  • Reviewing a WooCommerce plugin before release
  • SKILL.md covers How to use this skill, Adapt to the project first, The Rules and Self-check before delivery, plus 4 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

This is a guard pass for WooCommerce extensions, payment and shipping integrations, checkout customizations and order or product logic, applied after an agent writes or edits code. It targets systematic failures of AI-written Woo code: order meta read through get_post_meta, which breaks on HPOS stores, direct meta writes that skip lookup tables and hooks, checkout validated only in JavaScript, floats for prices, and woocommerce hooks registered before checking that WooCommerce is active.

Three modes exist: guard-pass on a diff or files followed by a self-check, live mode when invoked before writing, and review mode, which walks a checklist and produces a findings report without editing code. A security floor applies throughout: context-correct escaping, unslash and sanitize request data, capability checks plus nonces on state changes, and prepared queries. The agent first reads the project's instructions, the declared WooCommerce range, the order storage mode and the checkout in use. It defers to separate guard skills for plain WordPress, generic review and tests.

When your agent uses it

  • Reviewing a WooCommerce plugin before release
  • Checking whether order code is compatible with HPOS
  • Auditing checkout customizations for server-side validation
  • Reviewing code that hooks into the order flow or updates stock

Example prompts

  • “Review this Woo plugin and tell me whether it is HPOS compatible.”
  • “I just added a checkout field; check its validation and saving code.”
  • “Audit my payment gateway class for money-handling mistakes.”

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Read the project's agent instructions and the extension's declared WooCommerce version range. Project conventions win on conflict.
  2. Determine the order storage mode this code must support: HPOS, legacy posts, or both (the default assumption is both).
  3. Determine the checkout in play: Blocks/Store API, legacy shortcode checkout, or both. Hooks for one do not fire in the other.
  4. Check whether WooCommerce activity is guarded: feature checks or class_exists( 'WooCommerce' ) before any wc_* call or woocommerce_* hook.

What it can do on your machine

Read from SKILL.md and the folder at commit ffa2603. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

WooCommerce Code Guard loads about 2.2k tokens when it runs, and up to ~4.9k if it reads all its reference files. Until then it costs about 254 tokens; SKILL.md has 973 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~254
When it runs · the whole SKILL.md, loaded when a task matches
~2.2k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~4.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from amElnagdy/guard-skills at commit ffa2603, republished under its MIT licence (© amElnagdy). 973 words, ~2,158 tokens.

Download SKILL.mdSave it as .claude/skills/woo-guard/SKILL.md (or your agent's skills folder). This skill also uses 5 other files; get the full folder from GitHub.
name
woo-guard
description
Review generated or changed WooCommerce code — extensions, payment and shipping integrations, checkout customizations, and order/product logic — before it ships. Best used reactively after an agent writes, edits, or reviews code touching WooCommerce APIs: wc_get_order, wc_get_orders, wc_get_product, WC() cart or session, woocommerce_* hooks, Store API endpoints, payment gateways, order or product meta, HPOS, subscriptions, or bookings. Use on 'review this Woo plugin', 'is this HPOS compatible', or after tasks like 'write a WooCommerce extension', 'add a checkout field', 'hook into the order flow', or 'update stock'. Enforces HPOS-safe order access, CRUD over direct meta, feature-compatibility declarations, server-side checkout validation, money-handling discipline, and hooks over template overrides. DO NOT USE for WordPress code without WooCommerce APIs (use wp-guard), generic code review (use clean-code-guard), test review (use test-guard), or store configuration and admin-screen questions.

Woo Guard

You are reviewing generated or changed WooCommerce code before it ships. Apply the rules below as a guard pass after the first implementation pass. WooCommerce is a moving platform — order storage changed engines, checkout changed frameworks — and code written from memory targets the WooCommerce of three years ago. With money on the line, "works on my demo store" is not a standard.

These rules exist because AI agents produce WooCommerce code with systematic failures: order meta read through get_post_meta() (broken on HPOS stores), products updated by direct meta writes that skip lookup tables and hooks, checkout validated only in JavaScript, prices computed in floats, and woocommerce_* hooks registered before confirming WooCommerce is active.

How to use this skill

Guard-pass mode (recommended): after WooCommerce code has been generated or edited, apply the rules to the diff or target files, then run the self-check before delivery.

Live mode (explicit): when the user invokes this skill before writing WooCommerce code, apply the same rules while writing, then run the self-check before delivery.

Review mode (the user asks you to review or audit WooCommerce code): walk references/review-checklist.md and produce a structured findings report. Do not edit code in review mode unless asked.

Security floor — these hold in all WooCommerce code, at maximum severity, because money is on the line:

  • Escape all output with the context-correct esc_* function.
  • wp_unslash() then sanitize all request data before it touches logic.
  • Capability check plus nonce on every state change.
  • $wpdb->prepare() for every query containing a variable.

If wp-guard is installed, run it alongside for the full WordPress layer.

Adapt to the project first

  1. Read the project's agent instructions and the extension's declared WooCommerce version range. Project conventions win on conflict.
  2. Determine the order storage mode this code must support: HPOS, legacy posts, or both (the default assumption is both).
  3. Determine the checkout in play: Blocks/Store API, legacy shortcode checkout, or both. Hooks for one do not fire in the other.
  4. Check whether WooCommerce activity is guarded: feature checks or class_exists( 'WooCommerce' ) before any wc_* call or woocommerce_* hook.

The Rules

Order and product data — must fix

  1. Orders are not posts. Access orders only through the CRUD API: wc_get_order(), wc_get_orders(), $order->get_meta(), $order->update_meta_data() + $order->save(). Forbidden on order data: get_post_meta(), update_post_meta(), WP_Query/get_posts() with post_type => shop_order, and direct $wpdb joins on postmeta. These work on legacy stores and silently break on HPOS stores. Details: references/hpos-and-crud.md.

  2. CRUD objects, getters/setters, then save. Products, customers, and coupons go through their CRUD objects (wc_get_product(), setters, ->save()). Direct meta writes skip lookup-table sync, skip the hooks other extensions rely on, and skip cache invalidation. Stock changes go through wc_update_product_stock() semantics; order state changes through $order->update_status() — which fire the emails and hooks the store expects.

  3. Declare feature compatibility. Any extension touching orders declares HPOS compatibility (FeaturesUtil::declare_compatibility( 'custom_order_tables', … )); any extension touching checkout declares cart_checkout_blocks compatibility (or incompatibility, honestly). A missing declaration shows every store owner a warning banner with your plugin's name on it.

Checkout and money — must fix

  1. Checkout validation is server-side. Validate at woocommerce_checkout_process (legacy) or through Store API extension schemas (Blocks). JavaScript validation is UX, never security. Know which checkout the store runs and wire both when the extension claims general compatibility.

  2. Money is not a float. Prices and totals go through wc_format_decimal() for storage-safe values, wc_price() for display, and WooCommerce's own tax/rounding settings for arithmetic. No hand-rolled currency symbols, no number_format() on prices, no float equality on totals.

Show full SKILL.md (399 more words)Show less
Runtime discipline — should fix

  1. Guard the runtime context. WC()->cart and WC()->session are null in REST, cron, CLI, and admin contexts — check before touching them. Never assume a logged-in customer in webhook or gateway callbacks. Verify every woocommerce_* hook and wc_* function exists in the supported version range — WooCommerce renames and retires hooks across majors.

  2. Hooks over template overrides. Prefer, in order: existing WooCommerce hooks/filters → the woocommerce_locate_template filter → a theme-level override. A template override shipped inside a plugin freezes a copied file at one WooCommerce version and breaks on template updates — flag it in review, always.

  3. Background work scales with order volume. Batch jobs, syncs, and webhook fan-out go through Action Scheduler (bundled with WooCommerce), not raw WP-Cron loops. Handlers are idempotent — order events fire more than once in real stores.

Self-check before delivery

  1. Grep your diff for get_post_meta, update_post_meta, post_type => 'shop_order': any of them touching orders? (Rule 1)
  2. Any product/order/customer write that bypasses a CRUD object's save()? (Rule 2)
  3. Does the extension declare HPOS (and checkout-blocks, if relevant) compatibility? (Rule 3)
  4. Is every checkout rule enforced server-side, for the checkout(s) the store actually runs? (Rule 4)
  5. Any float arithmetic, hardcoded currency symbol, or number_format() on money? (Rule 5)
  6. Any WC()->cart/WC()->session access that can run in REST/cron/CLI? Any unverified hook name? (Rule 6)
  7. Any template file shipped in the plugin? (Rule 7)
  8. Security floor: every output escaped, every request input unslashed then sanitized, every state change capability-checked and nonce-verified, every variable query prepared?

If any answer is wrong, fix it before showing the user.

Reporting format (review mode)

**Rule N violation** in `path/file.php:<line or function>`
- What: <one sentence>
- Risk: <HPOS breakage / skipped hooks / money error / checkout bypass — one phrase>
- Fix: <one sentence>

Group by file, lead with Rules 1–5 findings. If a file is clean, don't mention it.

Severity guide

  • Must fix: Rules 1–5 — broken stores, skipped business logic, wrong money
  • Should fix: Rules 6–8 — context crashes, update fragility, jobs that die at scale

References

What this skill does not do

  • Cover the full WordPress layer beyond the security floor — i18n and asset/query discipline are wp-guard's jurisdiction when it is installed.
  • Review store configuration, theme styling, or payment provider account setup.
  • Decide pricing or business logic — it guards how WooCommerce code ships, not what the store sells.

© amElnagdy, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 5 other files (references) in skills/woo-guard of amElnagdy/guard-skills.

  • SKILL.md
  • agents/openai.yaml
  • references/checkout-and-money.md
  • references/hpos-and-crud.md
  • references/review-checklist.md
  • references/sources.md

Open the folder on GitHubat commit ffa2603

Compare with similar skills

WooCommerce Code Guard next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

WooCommerce Code Guard compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
WooCommerce Code Guard this skillamElnagdy/guard-skills1.3k—~2.2kAutomated safety check: PassMIT
WooCommerce Code Reviewwoocommerce/woocommerce11k3 repos~1.1kAutomated safety check: PassCustom licence
WooCommerce Backend Conventionswoocommerce/woocommerce11k1 repos~614Automated safety check: PassCustom licence
Skill Doli Code ReviewDolibarr/dolibarr7.7k1 repos~1.1kAutomated safety check: PassMIT
Dignified Python Standardsdocling-project/docling69k—~1.5kAutomated safety check: PassApache-2.0
Archify Reviewtt-a1i/archify82k—~415Automated safety check: PassMIT

Similar skills

  • WooCommerce Code Review

    woocommerce/woocommerce

    Reviews WooCommerce code changes against the project's standards, flagging backend PHP architecture, naming, documentation, data integrity and testing violations.

    11k GitHub starsUsed in 3 repos~1.1k tokens
    DevelopmentAuto-check passed

  • WooCommerce Backend Conventions

    woocommerce/woocommerce

    Guides agents writing or changing WooCommerce backend PHP so new classes, hooks and unit tests follow the project's conventions.

    11k GitHub starsUsed in 1 repo~614 tokens
    DevelopmentAuto-check passed

  • Skill Doli Code Review

    Dolibarr/dolibarr

    Reviews Dolibarr PHP code for compliance with coding standards and security best practices, and fixes identified issues.

    7.7k GitHub starsUsed in 1 repo~1.1k tokens
    DevelopmentAuto-check passed

  • Dignified Python Standards

    docling-project/docling

    Applies opinionated production Python conventions chosen by the project's Python version: modern type syntax, pathlib, explicit checks and interface guidance.

    69k GitHub stars~1.5k tokensUpdated today
    DevelopmentAuto-check passed

  • Archify Review

    tt-a1i/archify

    Review Archify issues, PRs, or code through value, cost, and impact to support evidence-based maintenance decisions. Use for issue triage, change reviews, and…

    82k GitHub stars~415 tokensUpdated today
    DevelopmentAuto-check passed

  • Code Review Skill

    awesome-skills/code-review-skill

    Provides comprehensive code review guidance for React 19, Vue 3, Angular 17+, Svelte 5, Rust, TypeScript, Java, Java 8, PHP, Ruby, Rails, Python, Django, FastAPI, Go, C/.NET, Kotlin, Swift, Dart…

    2.1k GitHub stars~2.8k tokensUpdated 1 mo ago
    DevelopmentAuto-check: notes

More from amElnagdy/guard-skills

  • Clean Code Guard

    amElnagdy/guard-skills

    Reviews generated or changed production code against Clean Code, SOLID, DRY, KISS, YAGNI and LLM-specific failure modes before it ships, in any language.

    1.3k GitHub starsUsed in 2 repos~4.3k tokens
    Auto-check passed

  • Test Guard

    amElnagdy/guard-skills

    Reviews newly written or edited tests against nine rules that cut test bloat, such as mock-heavy checks and near-duplicate cases, before they are committed.

    1.3k GitHub starsUsed in 2 repos~2.1k tokens
    Auto-check passed

  • Docs Guard

    amElnagdy/guard-skills

    Checks generated or edited documentation against the source code, flagging invented symbols, outdated samples and unverifiable claims before publishing.

    1.3k GitHub stars~2.1k tokensUpdated 3 mo ago
    Auto-check passed

  • WordPress Code Guard

    amElnagdy/guard-skills

    Reviews WordPress plugin, theme and block code after an agent writes or edits it, catching missing escaping, nonces, capability checks and unprepared queries.

    1.3k GitHub stars~2.4k tokensUpdated 3 mo ago
    Auto-check passed

Works with

Categories

Questions about WooCommerce Code Guard

What does WooCommerce Code Guard do?

Reviews generated or changed WooCommerce code for HPOS safety, CRUD use, checkout validation and money handling before it ships. This is a guard pass for WooCommerce extensions, payment and shipping integrations, checkout customizations and order or product logic, applied after an agent writes or edits code. It targets systematic failures of AI-written Woo code: order meta read through get_post_meta, which breaks on HPOS stores, direct meta writes that skip lookup tables and hooks, checkout validated only in JavaScript, floats for prices, and woocommerce hooks registered before checking that WooCommerce is active.

When should I use WooCommerce Code Guard?

WooCommerce Code Guard fits situations like: reviewing a WooCommerce plugin before release; checking whether order code is compatible with HPOS; auditing checkout customizations for server-side validation; reviewing code that hooks into the order flow or updates stock.

How do I install WooCommerce Code Guard in Claude Code?

Run `npx skills add amElnagdy/guard-skills --skill woo-guard -a claude-code`. Or copy the skill folder (skills/woo-guard in amElnagdy/guard-skills) into .claude/skills/woo-guard in your project. Claude Code loads it when a task matches its description.

How do I install WooCommerce Code Guard in Codex?

Run `npx skills add amElnagdy/guard-skills --skill woo-guard -a codex`. Or copy the skill folder (skills/woo-guard in amElnagdy/guard-skills) into .agents/skills/woo-guard in your project. Codex loads it when a task matches its description.

Can I use WooCommerce Code Guard in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add amElnagdy/guard-skills --skill woo-guard -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/woo-guard, .gemini/skills/woo-guard, .github/skills/woo-guard and .opencode/skills/woo-guard in your project.

What does WooCommerce Code Guard need to run?

SKILL.md names no scripts, command-line tools or credentials: WooCommerce Code Guard is instructions for the agent only.

Does WooCommerce Code Guard access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is WooCommerce Code Guard safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does WooCommerce Code Guard use?

WooCommerce Code Guard is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does WooCommerce Code Guard use?

About 2.2k tokens (SKILL.md is roughly 8.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 2.7k tokens, read only when the agent opens those files.

What are the alternatives to WooCommerce Code Guard?

Skills that share tags, products or a category with WooCommerce Code Guard: WooCommerce Code Review (woocommerce/woocommerce, 11k stars), WooCommerce Backend Conventions (woocommerce/woocommerce, 11k stars), Skill Doli Code Review (Dolibarr/dolibarr, 7.7k stars) and Dignified Python Standards (docling-project/docling, 69k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains WooCommerce Code Guard?

amElnagdy (a GitHub user) maintains it in amElnagdy/guard-skills, which has 1,261 GitHub stars. The repository holds 5 skills in this directory. The repository was last updated on July 4, 2026.

Source: amElnagdy/guard-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.