Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/detecting-suspicious-powershell-execution/SKILL.md

@@ -1,7 +1,10 @@
 ---
 name: detecting-suspicious-powershell-execution
-description: Detect suspicious PowerShell execution patterns including encoded commands,
-  download cradles, AMSI bypass attempts, and constrained language mode evasion.
+description: Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands,
+  download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry
+  (CrowdStrike, Microsoft Defender for Endpoint), Sysmon, and SIEM queries (Splunk, Elastic).
+  Use when proactively threat hunting, triaging EDR/SIEM alerts, or scoping an incident
+  involving malicious PowerShell activity.
 domain: cybersecurity
 subdomain: threat-hunting
 tags: