# Build WooCommerce Backend PHP with Project Standards

WooCommerce backend changes can fail review when they ignore project conventions. This skill guides compliant classes, hooks, data operations, annotations, and tests.

## Install

```bash
npx skillstore add woocommerce/woocommerce-backend-dev
```

## Metadata

- Status: approved
- Slug: woocommerce-woocommerce-backend-dev
- Skillstore revision: r2
- Version status: missing
- Tree hash: 4abe4352c4ef947314a2592cfe8a3d13911b3a925ae8893b07cba8c8128ad709
- Author: woocommerce
- GitHub username: woocommerce
- License: MIT
- Repository: https://github.com/woocommerce/woocommerce/tree/trunk/.ai/skills/woocommerce-backend-dev
- Ref: 88a8e9a07f4c54ab105c1c41b6267c287146b07b
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/woocommerce-woocommerce-backend-dev
- Manifest: https://skillstore.pages.dev/api/skills/woocommerce-woocommerce-backend-dev/manifest

## Capabilities

- Guides class placement, PSR-4 namespaces, imports, and file naming.
- Applies WooCommerce naming, visibility, static method, and docblock conventions.
- Documents action and filter hooks with parameters and version annotations.
- Uses the WooCommerce dependency injection container and initialization pattern.
- Adds validation, ownership checks, and error handling around data changes.
- Structures PHPUnit tests with WooCommerce fixtures, testdox, data providers, and logger mocks.

## Use Cases

- Implement a backend feature: Create an internal service with correct placement, naming, injection, documentation, and tests.
- Refactor a data workflow: Improve order or cart operations with validation, ownership checks, and honest PHPStan types.
- Review a backend change: Check hooks, docblocks, test structure, and repository conventions before approving a pull request.

## Prompt Templates

### Create an internal class

```
Create a WooCommerce internal class for [purpose]. Follow repository naming, namespace, visibility, dependency injection, docblock, and file placement conventions.
```

### Add a documented hook

```
Add a WooCommerce [action or filter] for [event]. Include the callback pattern, complete hook documentation, parameters, and the correct since version.
```

### Secure a data operation

```
Implement [data operation] for [entity]. Validate existence, state, ownership, capabilities, return values, race conditions, and failure handling.
```

### Refactor and test a service

```
Refactor [service] to use dependency injection and accurate PHPStan types. Preserve runtime behavior and add focused tests for success, failure, and retry paths.
```

## Limitations

- It does not execute tests, linting, or migrations by itself.
- Its conventions target the WooCommerce repository, not every WordPress plugin.
- It does not replace security review for authorization, payment, or destructive operations.
- Version annotation guidance depends on access to the current trunk source.

## Best Practices

- Inspect nearby WooCommerce code before choosing placement, dependencies, and public APIs.
- Validate entity state, ownership, capabilities, and return values before changing data.
- Run focused tests and linting for every modified backend path.

## Anti Patterns

- Do not add standalone functions when a testable class method fits the repository design.
- Do not remove runtime behavior only to silence a static analysis warning.
- Do not perform destructive data operations without validation and authorization.

## Security Audit

- Audited at: 2026-07-24T01:50:06.417\+00:00
- Summary: All 60 static alerts are false positives. The blocker alerts cite PHP examples and documentation, while the external command alerts are Markdown code spans rather than executable shell syntax. No prompt injection, exfiltration, or malicious intent was found.

## Stats

- Views: 430
- Downloads: 11
- Favorites: 0
- Popularity score: 0