Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/analyzing-command-and-control-communication/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: analyzing-command-and-control-communication
-description: 'Analyzes malware command-and-control (C2) communication protocols to
-  understand beacon patterns, command structures, data encoding, and infrastructure.
-  Covers HTTP, HTTPS, DNS, and custom protocol C2 analysis for detection development
-  and threat intelligence. Activates for requests involving C2 analysis, beacon detection,
-  C2 protocol reverse engineering, or command-and-control infrastructure mapping.
+description: 'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom
+  protocols to reverse-engineer beacon patterns, command structures, data encoding,
+  and infrastructure (primary servers, fallback domains, dead drops). Use after
+  reverse engineering reveals network traffic needing protocol analysis or when
+  building detection signatures for a framework like Cobalt Strike, Metasploit,
+  or Sliver.
 
   '
 domain: cybersecurity