Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/implementing-web-application-logging-with-modsecurity/SKILL.md

@@ -1,13 +1,10 @@
 ---
 name: implementing-web-application-logging-with-modsecurity
-description: 'Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application
-  logging, tune rules to reduce false positives, analyze audit logs for attack detection,
-  and implement custom SecRules for application-specific threats. The analyst configures
-  SecRuleEngine, SecAuditEngine, and CRS paranoia levels to balance security coverage
-  with operational stability. Activates for requests involving WAF configuration,
-  ModSecurity rule tuning, web application audit logging, or CRS deployment.
-
-  '
+description: Configure ModSecurity WAF with the OWASP Core Rule Set (CRS) for web
+  application audit logging, tuning SecRuleEngine, SecAuditEngine, and CRS paranoia
+  levels to reduce false positives, and writing custom SecRules for application-specific
+  threats. Use when deploying or tuning a ModSecurity WAF, analyzing audit logs for
+  attack detection, or reducing CRS false positives.
 domain: cybersecurity
 subdomain: web-application-security
 tags: