at(1) should not popen /usr/bin/pwd
For some reason I can't currently fathom, at(1) popens /usr/bin/pwd
It opens a pipe, forks, and in the child setuid's to the real user, then popens /usr/bin/pwd and writes the result back up the pipe to the parent. It's vaguely possible that there's a good reason for this, but I'm not at the moment seeing it.
At the very least, I can't come up with a reason it could not just call getcwd(3C) in the child.