Dx Terminal Pro
WarnAudited by ClawScan on May 10, 2026.
Overview
Dx Terminal Pro matches its stated trading-agent purpose, but it can use a raw private key to sign on-chain transactions that change trading behavior or move ETH, so it needs careful review.
Only install this if you intentionally want OpenClaw to help manage a DX Terminal Pro trading agent. Use a dedicated low-balance wallet, verify the vault and transaction details independently, keep the private key protected, and require explicit approval for every on-chain action, especially deposits, withdrawals, settings changes, and strategy updates.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A mistaken or unintended invocation could change trading risk, alter the agent's behavior, deposit funds, or withdraw funds; blockchain transactions may be irreversible.
The skill documents direct on-chain transaction commands that can modify vault settings, add or disable strategies, and move ETH. These are high-impact actions, and the provided artifact text does not show an explicit user confirmation or simulation requirement before sending transactions.
`cast send "$VAULT_ADDRESS" "updateSettings..." ... --private-key "$DX_TERMINAL_PRIVATE_KEY" --rpc-url "https://mainnet.base.org"`; also `depositETH()` and `withdrawETH(uint256)` examples
Require explicit user approval before every `cast send`, showing the vault address, method, amount, network, and parameters. Prefer simulation/read-only checks first and avoid letting the agent send transactions automatically.
If the key is exposed or used incorrectly, funds or trading-agent control could be lost or misused.
The skill requires a raw private key and uses it for signing on-chain actions. This credential is disclosed and purpose-aligned, but it is not a scoped API token; possession of the key can grant broad account authority.
`DX_TERMINAL_PRIVATE_KEY` controls and identifies a trading agent ... `cast send ... --private-key "$DX_TERMINAL_PRIVATE_KEY"`
Use a dedicated low-balance wallet/private key only for this vault, never a primary wallet. Keep the key out of logs and shared environments, rotate it if exposed, and prefer wallet-confirmation or scoped authorization if available.
A poor or unintended strategy could keep affecting trades and potentially cause continuing financial loss until disabled or expired.
The skill can create persistent instructions and settings that influence future autonomous trades, so one bad update can continue affecting the account beyond the immediate interaction.
`Influence a trading agent by modifying its settings and strategies` and `Strategies are instructions to direct the trading agent's behavior ... priorities + an expiry time.`
Use short expiries for strategies, review active strategies regularly, confirm settings after changes, and keep a clear rollback or disable procedure.
Users must trust that the documented endpoints, contract calls, and vault address resolution are legitimate.
There is no installable code to inspect, but the skill provenance is not clearly tied to a reviewed source. This matters more because the instructions involve private-key use and on-chain financial actions.
Source: unknown; No install spec — this is an instruction-only skill.
Verify the skill, homepage, API domain, contract/vault address, and transaction calldata through trusted DX Terminal Pro documentation before using a funded key.