unless `eb_sandbox.sh` is being sources, this can't leak into the enclosing shell?