The command used for broadcasting was wrong.

The correct command is:

am broadcast -n com.ishacker.android.cmdreceiver/.CmdReceiver --es Cmd "whoami"

The -n flag specifies the component name explicitly. Without it, the broadcast may not be delivered correctly to the receiver, and trying to get extras with intent.getStringExtra() will result in it returning null.

Thanks @Maveňツ for posting the suggestion in the comments.