opena2a scan

Run security checks against AI agents. Adapter for HackMyAgent.

Usage

opena2a scan [target] [options]

Description

Delegates to HackMyAgent for the full 318 static + 29 semantic + 164 adversarial check suite, covering prompt injection, tool misuse, excessive agency, and data exfiltration. Supports attack simulation mode and auto-fix remediation.

This command passes all flags through to hackmyagent. See HackMyAgent documentation for the full flag reference.

Common Flags

Flag	Description
`--fix`	Automatically fix issues where possible.
`--dry-run`	Preview fixes without applying them (use with --fix).
`--ignore <checks>`	Comma-separated check IDs to skip.
`-f, --format <text\|json\|sarif\|html\|asff>`	Output format.
`--fail-below <percent>`	Exit 1 if compliance is below the threshold (0-100).
`-b, --benchmark <name>`	Run a benchmark compliance check (oasb-1, oasb-2).
`--ci`	CI mode with exit code on failures.

Examples

# Basic scan

opena2a scan

# Preview fixes, then apply them

opena2a scan --fix --dry-run
opena2a scan --fix

# OASB-1 benchmark with a CI threshold

opena2a scan -b oasb-1 --fail-below 80

# CI pipeline with SARIF output

opena2a scan --ci --format sarif > results.sarif

What the output contains

The report lists every failing check with its ID, severity and file location, a score out of 100 with the recoverable points named per finding, and the fix command for each finding. Run opena2a scan in your project to see the current result; the counts depend on the bundled HackMyAgent version and on your tree.

Integration with review

The review command includes an HMA scan as one of its six analysis phases. The scan findings contribute 8% to the composite review score. If HackMyAgent is not installed, use --skip-hma with review to skip this phase. For standalone scanning with more control over check categories and output format, use opena2a scan directly.

Common Workflows

# Scan, fix, and verify in one workflow

opena2a scan                    # identify issues
opena2a scan --fix               # apply fixes
opena2a scan                    # verify fixes applied

# Skip named checks without changing the score

opena2a scan --ignore GIT-002

Error Handling

In CI mode (--ci), the command exits with code 1 if any critical findings are detected. Warnings do not cause a non-zero exit. If HackMyAgent is not installed, the command prints an installation instruction and exits with code 1. Use --format sarif to upload results directly to GitHub Code Scanning via the codeql-action/upload-sarif action.

HackMyAgent docs benchmark protect review