diff --git a/.github/workflows/daily-vulnhunter-scan.lock.yml b/.github/workflows/daily-vulnhunter-scan.lock.yml
index 11930e57944..86977537dfe 100644
--- a/.github/workflows/daily-vulnhunter-scan.lock.yml
+++ b/.github/workflows/daily-vulnhunter-scan.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"5f7e1cd29e3ca0e84205de47c594770818b70d9a9a9689b6685193ce970306b2","body_hash":"a48dbec98bfea6f55c1ae6e80414c0759b46e692b7c5712b5c122f80dd909fcd","strict":true,"agent_id":"claude","agent_model":"claude-sonnet-4.6","engine_versions":{"claude":"2.1.216"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"5f7e1cd29e3ca0e84205de47c594770818b70d9a9a9689b6685193ce970306b2","body_hash":"25bdc06d98c7da8265c15256225306a4fdfdc0c1d8792e15f368bb8ba112517e","strict":true,"agent_id":"claude","agent_model":"claude-sonnet-4.6","engine_versions":{"claude":"2.1.216"}}
 # gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GH_AW_OTEL_GRAFANA_AUTHORIZATION","GH_AW_OTEL_GRAFANA_ENDPOINT","GH_AW_OTEL_SENTRY_AUTHORIZATION","GH_AW_OTEL_SENTRY_ENDPOINT","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/cache/save","sha":"55cc8345863c7cc4c66a329aec7e433d2d1c52a9","version":"v6.1.0"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"820762786026740c76f36085b0efc47a31fe5020","version":"v7.0.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37","digest":"sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.37@sha256:0d35e8682845f183c1c634699a8e8a6cbe2c271b867031410df74533243c5f67"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37","digest":"sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.37@sha256:fc2970aadaeae05993e76697d29f03dc8bfb9248ff87a8f3d8b0975485a4b317"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37","digest":"sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.37@sha256:5abc51995e5901c5d1daeefc957301ee409980e2e607391ec22c06cb2513327b"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.4.3","digest":"sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.4.3@sha256:3c744710ea275cd5ee65db92a1099e0d980754bd9fafda9ce67704c67004dc83"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.6.0","digest":"sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3","pinned_image":"ghcr.io/github/github-mcp-server:v1.6.0@sha256:2b0c48b070f61e9d3969269ead600f62d00fb237b60ac849ef3d166ee7de9ad3"}]}
 # This file was automatically generated by gh-aw. DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
diff --git a/.github/workflows/daily-vulnhunter-scan.md b/.github/workflows/daily-vulnhunter-scan.md
index de8063e9228..1f7bc7ba5cb 100644
--- a/.github/workflows/daily-vulnhunter-scan.md
+++ b/.github/workflows/daily-vulnhunter-scan.md
@@ -98,20 +98,22 @@ Run Capital One's [VulnHunter](https://github.com/capitalone/VulnHunter) methodo
 ## Task
 
 1. Read `/tmp/gh-aw/agent/vulnhunter/README.md` for the prepared bundle layout.
-2. Read the extracted scanner instructions before analyzing the repository snapshot:
-   - `/tmp/gh-aw/agent/vulnhunter/vulnhunter/README.md`
-   - `/tmp/gh-aw/agent/vulnhunter/vulnhunter/vulnhunt/README.md`
+2. Load only the core scanner instructions:
    - `/tmp/gh-aw/agent/vulnhunter/vulnhunter/vulnhunt/SKILL.md`
-   - every file under `/tmp/gh-aw/agent/vulnhunter/vulnhunter/vulnhunt/phases/`
-3. Follow the extracted `vulnhunt` instructions as your operating playbook and scan `/tmp/gh-aw/agent/vulnhunter/repo` for verified, exploitable vulnerabilities.
-4. Save your intermediate notes and any machine-readable findings under `/tmp/gh-aw/agent/vulnhunter/out/`.
+   - List the files under `/tmp/gh-aw/agent/vulnhunter/vulnhunter/vulnhunt/phases/` and select **at most 2 phases** most applicable to a Go CLI codebase (e.g. injection, secrets). Read only those phase files.
+3. Scope the scan to the highest-risk entry points in `/tmp/gh-aw/agent/vulnhunter/repo`:
+   - User-controlled input handling and shell/exec call sites
+   - Authentication, token handling, and secrets management
+   - Network request construction and URL/header injection paths
+   - Do **not** exhaustively scan every file — prioritize files likely to contain critical vulnerabilities.
+4. Apply the selected phases to the scoped entry points, falsify any candidate findings, and save confirmed findings to `/tmp/gh-aw/agent/vulnhunter/out/`.
 
 ## Reporting Rules
 
 - Only report findings that survive VulnHunter's falsification/disproof process.
 - Do not report speculative, low-confidence, or test-only issues.
 - If there are no verified exploitable findings, call `noop` with a short explanation.
-- If there are verified findings, create exactly one issue summarizing up to the 5 highest-confidence vulnerabilities.
+- If there are verified findings, create exactly one issue summarizing up to the 3 highest-confidence vulnerabilities.
 
 ## Issue Format