woo-guard

Woo Guard is a defensive code-review skill that vets generated or changed WooCommerce code — extensions, payment and shipping integrations, checkout customizations, and order/product logic — before it ships. It exists because AI-generated WooCommerce code systematically targets an outdated platform: reading order meta through `get_post_meta()` (which breaks on High-Performance Order Storage), updating products via direct meta writes that skip lookup tables and hooks, validating checkout only in JavaScript, computing prices in floats, and registering hooks before confirming WooCommerce is active. With money on the line, the skill treats "works on my demo store" as insufficient.

It operates in three modes — a guard pass over a diff after code is written, a live mode while writing, and a review mode that walks a checklist to produce a structured findings report. Its rules enforce HPOS-safe order access through the CRUD API, CRUD objects and setters over direct meta writes, feature-compatibility declarations, server-side checkout validation across both the Blocks/Store API and legacy shortcode surfaces, disciplined money handling (`wc_format_decimal`, `wc_price`, integer minor units, webhook idempotency and signature verification), and hooks over template overrides. A security floor mandates output escaping, unslashing and sanitizing request data, capability-plus-nonce checks on state changes, and prepared database queries. Reference files cover HPOS/CRUD, checkout/money, a review checklist, and sources.

It targets WordPress/WooCommerce plugin developers and AI agents producing store code who need a compatibility and security safety net. This is defensive, security-conscious guidance — it hardens code rather than attacking anything.