Rewrite 548 skill descriptions to the activation rubric

Each rewritten description now states both what the skill does (concrete
capability, named tools/artifacts) and an explicit when-to-use trigger,
improving agent discovery/activation. Grounded in each skill's own body;
changes confined to the `description` field only (bodies and all other
frontmatter untouched). Produced by a gated audit->rewrite->recheck loop
(548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded).

Schema: 817/817 pass. Framework-ID gate: 0 defects.

skills/tracking-threat-actor-infrastructure/SKILL.md

@@ -1,8 +1,11 @@
 ---
 name: tracking-threat-actor-infrastructure
-description: Threat actor infrastructure tracking involves monitoring and mapping
-  adversary-controlled assets including command-and-control (C2) servers, phishing
-  domains, exploit kit hosts, bulletproof hosting, a
+description: Discovers and maps adversary-controlled infrastructure (C2 servers,
+  phishing domains, exploit-kit hosts, bulletproof hosting) by pivoting across passive
+  DNS, certificate transparency logs, Shodan/Censys scans, WHOIS records, and network
+  fingerprints (JARM/JA3S). Use when tracking threat actor infrastructure, expanding
+  a known IOC into related assets, or producing STIX-based threat intelligence during
+  a CTI investigation.
 domain: cybersecurity
 subdomain: threat-intelligence
 tags: