Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/reverse-engineering-android-malware-with-jadx/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: reverse-engineering-android-malware-with-jadx
-description: 'Reverse engineers malicious Android APK files using JADX decompiler
-  to analyze Java/Kotlin source code, identify malicious functionality including data
-  theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest
-  permissions, receivers, services, and native libraries. Activates for requests involving
-  Android malware analysis, APK reverse engineering, mobile malware investigation,
-  or Android threat analysis.
+description: 'Reverse engineers malicious Android APK files using the JADX decompiler
+  to read Java/Kotlin source, inspect manifest permissions, receivers, services, and
+  native libraries, and identify data theft, C2 communication, privilege escalation,
+  or overlay-attack behavior. Use when analyzing a suspected Android banking trojan,
+  spyware, SMS stealer, or other flagged APK, or when investigating mobile malware
+  or Android threats generally.
 
   '
 domain: cybersecurity