Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/performing-yara-rule-development-for-detection/SKILL.md

@@ -1,8 +1,10 @@
 ---
 name: performing-yara-rule-development-for-detection
-description: Develop precise YARA rules for malware detection by identifying unique
-  byte patterns, strings, and behavioral indicators in executable files while minimizing
-  false positives.
+description: Develops precise YARA and YARA-X rules for malware detection by identifying
+  unique strings, byte sequences, PE header traits, and behavioral indicators in
+  unpacked malware artifacts while minimizing false positives. Use when building
+  detection signatures for threat hunting, classifying malware families, or authoring
+  rules from IOCs such as C2 URLs, mutex names, and encryption constants.
 domain: cybersecurity
 subdomain: malware-analysis
 tags: