Web Access 2.5.4 is an agent policy plus a local CDP proxy
Web Access 2.5.4 combines written instructions with Node.js scripts that connect an agent to Chrome, Edge, or another Chromium browser. The instructions tell the agent when to use search, static fetching, curl, Jina, or the browser. Once browser control is necessary, a local HTTP proxy exposes navigation, DOM evaluation, clicking, scrolling, screenshots, and file selection. This is useful for dynamic pages and private sites that already work in the user's browser.
The main README and SKILL.md are written in Chinese. A language menu links to an English OpenAITX rendering, along with 8 other translations. The English option helps a reader understand the feature list, though the source comments, operating prompts, and most issue reports remain Chinese. Teams that review automation policy in English should budget for their own translation and verify it against the 18,430-byte SKILL.md at the measured commit.
What happened when we ran it
Our harness stopped before execution because it had no supported path for this JavaScript skill layout and found no Dockerfile. It therefore produced no install timing, build outcome, test result, dependency total, or vulnerability audit. That is a limit of this review's sandbox evidence. The correct takeaway is that Web Access needs a manual trial in the exact agent and browser environment where it will hold authority.
The documented path starts with Node.js 22 or newer, then asks Chrome or Edge to allow remote debugging. A dependency script creates config.env, identifies the chosen browser, launches the proxy, and checks its health on port 3456. The proxy can persist between tasks, while a restart may prompt for browser consent again. None of those steps was exercised by our harness, so we cannot claim that version 2.5.4 connected successfully on Linux, macOS, Windows, or WSL2.
Port 3456 gives the agent access to an existing browser session
The proxy binds to 127.0.0.1:3456, which keeps its HTTP interface off the network by default. Its authority is still broad: /eval runs JavaScript in a selected tab, /clickAt sends mouse events, /setFiles supplies local file paths, and /screenshot writes captured images. The skill deliberately uses the daily browser so authenticated sites work without a second login. That convenience places email, social accounts, internal systems, and saved browser state within the agent's possible reach.
An open screenshot path-handling pull request says the measured code writes the requested screenshot path without a directory allowlist and constructs its image content type from an unchecked format value. The proposed fix was still open. Loopback binding reduces remote exposure, but it does not make every local caller or agent decision safe. Review the proxy source, constrain the agent's filesystem rights, and use a separate browser profile for accounts that cannot tolerate an accidental click.
Chrome and Edge support excludes Firefox and isolated backends
Version 2.5.4 accepts Chrome or Edge as stored browser preferences and can discover related Chromium builds. Firefox support remains issue 27. The current design also assumes access to a user's existing profile. Issue 165 asks for pluggable browser backends so ordinary research can use an agent-owned browser and reserve the personal CDP session for work that truly needs a login. That separation does not exist in the measured commit.
Concurrency needs similar care. Managed tabs are tracked and closed after 900,000 idle milliseconds, or 15 minutes, with a cleanup pass every 60 seconds. Issue 161 reports no simultaneous-tab ceiling, even though the skill encourages parallel agents to open separate tabs. A cancelled task can leave tabs until cleanup, and a busy research job can create many before any becomes idle. Set a conservative work pattern and inspect the proxy's managed-tab count instead of treating parallel browsing as free.
August activity is newer than the v2.5.1 release
GitHub recorded the last code push on August 19, 2026, for commit 33eef84, which labels itself version 2.5.4. The latest GitHub release is older: v2.5.1 was published on May 15, 2026. Issue activity continued through August 27, and the repository showed 8,809 stars with 47 combined issues and pull requests. The older release tag is therefore a packaging mismatch, not evidence that development stopped. Main-branch users receive behavior newer than the latest release page describes.
The repository states MIT in the README, SKILL.md, and plugin metadata, yet its tree contains no LICENSE file and GitHub detects no license. That omission is easy for an individual to overlook and hard for a company review to wave through. Web Access is most persuasive as an inspectable set of instructions for a power user who understands the browser authority being granted. Playwright MCP or Chrome DevTools MCP offers a clearer tool boundary when a team prefers a dedicated browser service over a policy file tied to one personal session.