opena2a scan

Run security checks against AI agents. Adapter for HackMyAgent.

Usage

opena2a scan [target] [options]

Description

Delegates to HackMyAgent for 147 security checks including prompt injection, tool misuse, excessive agency, and data exfiltration. Supports attack simulation mode and auto-fix remediation.

This command passes all flags through to hackmyagent. See HackMyAgent documentation for the full flag reference.

Common Flags

FlagDescription
--attackEnable attack simulation mode.
--auto-fixAutomatically apply recommended fixes.
--checks <list>Run specific check categories.
--format <text|json|sarif>Output format.
--ciCI mode with exit code on failures.

Examples

# Basic scan
opena2a scan
# Scan with attack simulation
opena2a scan --attack
# Scan and auto-fix issues
opena2a scan --auto-fix
# CI pipeline with SARIF output
opena2a scan --ci --format sarif > results.sarif

Expected Output

$ opena2a scan

HackMyAgent Security Scan
=========================
Target: ./my-agent

Checks: 147 total | 139 passed | 5 warnings | 3 critical

CRITICAL  CRED-001  Hardcoded API key in src/config.ts:12
CRITICAL  CRED-003  AWS credentials in .env (not gitignored)
CRITICAL  INJ-007   No prompt injection guard on user input handler
WARNING   MCP-002   MCP server config allows unrestricted tool access
WARNING   GOV-001   No SOUL.md governance file found

Score: 42/100 (recoverable to 89 by fixing 3 critical findings)

Run 'opena2a scan --auto-fix' to apply automated remediations.

Integration with review

The review command includes an HMA scan as one of its five analysis phases. The scan findings contribute 10% to the composite review score. If HackMyAgent is not installed, use --skip-hma with review to skip this phase. For standalone scanning with more control over check categories and output format, use opena2a scan directly.

Common Workflows

# Scan, fix, and verify in one workflow
opena2a scan                    # identify issues
opena2a scan --auto-fix          # apply fixes
opena2a scan                    # verify fixes applied
# Run only credential checks
opena2a scan --checks credentials

Error Handling

In CI mode (--ci), the command exits with code 1 if any critical findings are detected. Warnings do not cause a non-zero exit. If HackMyAgent is not installed, the command prints an installation instruction and exits with code 1. Use --format sarif to upload results directly to GitHub Code Scanning via the codeql-action/upload-sarif action.

Related

HackMyAgent docsbenchmarkprotectreview