# Confess

> Proactive self-audit covering incomplete changes, untested assumptions, pattern violations, buried concerns, and cleanup debt. Invoke before ending a session, marking a task done, or saying "complete", and when the user asks "are you sure?", "did you miss anything?", "anything else?", or "audit your work". Do not wait to be asked.

- Skill: `b-open-io-prompts/confess` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add b-open-io-prompts/confess`
- Raw SKILL.md: https://api.skillmd.com/api/skills/b-open-io-prompts/confess/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: b-open-io (https://skillmd.com/u/b-open-io-prompts)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/b-open-io-prompts/confess

---


# Confess

A systematic self-audit skill that encourages honest discovery and disclosure of issues the agent may know about but hasn't mentioned. Especially good for admitting to reward hacking and coming clean.

## When to Use

- After completing implementation work
- When something feels incomplete
- Before marking a task as "done"
- When the user asks "what did I miss?" or "confess"

## Confession Categories

### 1. Incomplete Work
Search for related files that may also need changes:
- Use `grep` to find references to modified code
- Check for tests that need updating
- Look for documentation that references changed behavior

### 2. Untested Assumptions
Be honest about what was actually verified:
- Did you run the code or just build it?
- Were error paths tested?
- What edge cases weren't considered?

### 3. Pattern Violations
Compare against existing codebase:
- Find similar implementations with `glob`
- Does new code match existing patterns?
- Are there framework best practices being ignored?

### 4. Hidden Knowledge
Reveal things noticed but not mentioned:
- Potential issues spotted but not raised
- Concerns about the approach
- Shortcuts taken without disclosure
- Technical debt introduced

### 5. Cleanup Debt
Check for orphaned code:
- Dead code that should be removed
- Unused imports/dependencies
- Orphaned files/routes

## Adversarial Stance

**Do not ask "what did I miss?" — that question invites rationalization.**

Adopt the Skeptic's posture instead: *assume* something was missed, then hunt to prove it. Your job is to disprove your own "done" claim. A Skeptic is penalized for false dismissals, not for being thorough.

Run through this checklist before closing:
- [ ] Grep for every symbol you changed — are all callers updated?
- [ ] Does the test suite actually exercise the changed path, or just import it?
- [ ] Did you introduce any new import/dependency without documenting it?
- [ ] Is there anything you noticed but didn't mention because it was awkward to admit?
- [ ] What would break if someone reverted just your last commit?

## Workflow

1. **Gather Context**
   ```bash
   # What files were recently modified?
   git diff --name-only HEAD~1

   # What functions/exports changed?
   git diff HEAD~1 --stat
   ```

2. **Search for References**
   ```bash
   # Find all references to modified code
   grep -r "functionName" --include="*.ts" --include="*.tsx"
   ```

3. **Compare Patterns**
   - Find similar files in the codebase
   - Compare implementation approaches
   - Note any inconsistencies

4. **Verification Check**
   - List what was actually tested
   - List what was assumed to work
   - List what needs manual verification

5. **Disclose Everything**
   Format confessions as:
   ```
   ## My Confessions

   ### Incomplete Work
   - [specific issue]

   ### Untested
   - [what wasn't verified]

   ### Pattern Issues
   - [inconsistencies found]

   ### Hidden Concerns
   - [things I noticed but didn't mention]

   ### Cleanup Needed
   - [dead code, orphaned files]
   ```

## Key Principles

1. **Adversarial by design** — you are trying to catch yourself, not reassure yourself
2. **Assume the worst** — something is incomplete, something is untested, something was buried
3. **Tool-assisted** - Use grep/glob, don't rely on memory
4. **Systematic** - Cover all categories every time
5. **Honest** - If uncertain, say so
6. **Actionable** - Each confession should suggest a fix

## Example Output

After implementing OAuth error handling:

> ## My Confessions
>
> ### Incomplete Work
> - Modified `auth-config.ts` but `oauth2/authorize/page.tsx:173` still redirects to `/error/oauth`
> - `proxy.ts:67` also references the old error route
> - `lib/oauth-errors.ts` has `redirectToErrorPage()` function still using old pattern
>
> ### Untested
> - Only ran `bun run build`, didn't test actual OAuth error flow
> - Didn't verify error display on homepage with real error params
>
> ### Pattern Issues
> - Homepage uses `useSearchParams` directly, but other pages extract it into a Suspense-wrapped component
> - See: `oauth2/authorize/page.tsx`, `device/page.tsx` for correct pattern
>
> ### Hidden Concerns
> - The error page at `/error/[type]` is well-designed and actively used
> - Removing `onAPIError` may have been the wrong approach
>
> ### Cleanup Needed
> - Decision needed: fully migrate to homepage errors OR keep `/error/oauth` route