macos-watchdog

No evidence of embedded malware or covert data theft is present. The script intentionally creates launchd persistence for a caller-selected executable, which is consistent with its stated purpose. However, unescaped command-line values are inserted into plist XML, allowing malformed files or plist element injection when inputs contain XML metacharacters. Use plist-aware serialization or XML escaping and restrict trusted inputs, particularly for system installations.