Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/reverse-engineering-rust-malware/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: reverse-engineering-rust-malware
-description: Reverse engineer Rust-compiled malware using IDA Pro and Ghidra with
-  techniques for handling non-null-terminated strings, crate dependency extraction,
-  and Rust-specific control flow analysis.
+description: Reverse engineers Rust-compiled malware using IDA Pro and Ghidra, covering
+  techniques for non-null-terminated fat-pointer strings, monomorphized/duplicated
+  generic code, Result/Option unwrap chains, crate dependency extraction, and Rust-specific
+  control flow and calling conventions. Use when analyzing Rust-based malware samples
+  (e.g. BlackCat/ALPHV, Hive, Buer Loader) or attack artifacts in an authorized, controlled
+  environment.
 domain: cybersecurity
 subdomain: malware-analysis
 tags: