Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/implementing-siem-correlation-rules-for-apt/SKILL.md

@@ -1,10 +1,11 @@
 ---
 name: implementing-siem-correlation-rules-for-apt
-description: Write multi-event correlation rules that detect APT lateral movement
-  by chaining Windows authentication events, process execution telemetry, and network
-  connection logs across hosts. Uses Splunk SPL and Sigma rule format to correlate
-  Event IDs 4624, 4648, 4688, and Sysmon Events 1/3 within sliding time windows to
-  surface attack sequences invisible to single-event detections.
+description: Write multi-event correlation rules in Splunk SPL and Sigma format that
+  detect APT lateral movement by chaining Windows authentication events (4624, 4648),
+  process execution (4688, Sysmon Event 1), and network connections (Sysmon Event 3)
+  across hosts within sliding time windows. Use when building SIEM correlation searches
+  to surface multi-stage attack sequences that single-event detections miss, such
+  as pass-the-hash or lateral movement chains.
 domain: cybersecurity
 subdomain: security-operations
 tags: