dxkit-reportslisted

# dxkit-reports This skill runs dxkit analyzers and reads their output back to the user. It's the "tell me how my codebase is doing" surface. ## Command map | User asks | Command | Output | |---|---|---| | "Overall health" / "give me the score" | `npx vyuh-dxkit health` | 6-dimension score table + top actions per dimension | | "Check security" / "find vulns" | `npx vyuh-dxkit vulnerabilities` | Code-level SAST + dep-vuln + secret findings, grouped by severity | | "Test coverage gaps" | `npx vyuh-dxkit test-gaps` | Source files without matching tests, prioritized by architectural role | | "Code quality" | `npx vyuh-dxkit quality` | Lint findings + duplication + slop score | | "Who's been working on what" | `npx vyuh-dxkit dev-report` | Per-author activity, hot files, churn | | "License inventory" | `npx vyuh-dxkit licenses` | Every dependency's declared license | | "Bill of materials" | `npx vyuh-dxkit bom` | Licenses + dep vulnerabilities joined (15-col XLSX-ready output) | | "Run everything" | `npx vyuh-dxkit report` | Every analyzer in one shot, ~3-5 min | | "What has dxkit caught for us / ROI" | `npx vyuh-dxkit metrics` | Findings the gate blocked before merge, per week + by category (from the loop ledger) | | "How has the score moved over time" | `npx vyuh-dxkit report trend` | Per-dimension score-over-time sparklines since the first snapshot on record, from the on-merge snapshots; segmented at scoring-methodology boundaries so cross-version blips never read as real mo