Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/performing-lateral-movement-detection/SKILL.md

@@ -1,9 +1,13 @@
 ---
 name: performing-lateral-movement-detection
 description: 'Detects lateral movement techniques including Pass-the-Hash, PsExec,
-  WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows
-  event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral
-  Movement (TA0008) techniques.
+  WMI execution, RDP pivoting, and SMB-based spreading by correlating Windows Security/Sysmon
+  event logs, network flow data (NetFlow/Zeek), and endpoint telemetry in a SIEM,
+  mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques with sample SPL detection
+  queries. Use when a SOC team needs to detect attackers pivoting between internal
+  systems after initial compromise, trace an attacker''s movement path during an
+  incident investigation, or build detection engineering rules for TA0008; not for
+  detecting initial access or external attacks.
 
   '
 domain: cybersecurity