|It's not particularly dangerous, it's really about clobbering:|
1, Unlikely as it is, if there was another process called "__killtrickcmd__" it would be killed.
2. Another file named "__killtrickcmd__.exe" would provoke a similar problem.
3. Killing processes is undesirable.
That said cmd in xp has a very limited array of built in ways to obtain user input, and none with a time-out. The main option is "set /p" which requires the user to hit enter to return. An option for y/n is to create a file then "del /p file > nul" and use "if exist" to test the condition.
If the choice command had been included(or if you are willing to bring the executable with the script) then it would be fairly simple - run choice over ascii with a default option/time-out to a extended ansi character in a loop. The only problem with this method would be the loss of fx, arrow, del, ect. keys.
If it's only for 32bit systems then generating a .com with debug would be an option, but it's not a possibility on most 64bit systems. If you choose to go with the option someone else would have to write it because I'm not very good with debug...
Here is my "killtrick" version:
for %%a in (cmd.exe) do copy "%%~f$path:a" __killtrickcmd__.exe >nul
rem higher for slower
start /b __killtrickcmd__.exe /c "pause>nul"
ping 0.0.0.0 -n 2 >NUL
2>nul tskill __killtrickcmd__ || (
>nul del __killtrickcmd__.exe
set /a next+=1
if %next%==%change% (set next=0) else goto :loop
if %text%==c (set text=e) else set text=c