How is a transaction's output signed? In a transaction Tx, the hash pointer of the earlier transaction (say TxE) that serves as input to Tx must be signed by the sender S of Tx. This is to show that S was the recipient of TxE.
It remains to show that S agrees with the output of Tx. At which stage does S sign the output of Tx? 
I assume (s)he does so. Else, what would prevent an attacker from looking at Tx just after S broadcasted it, and modify the output (so that he is the recipient) before rebroadcast? 

In other words:
The scriptSig proves the sender owns the input of Tx. What proves that the sender approves the output of the Tx?

rgds

P.S: the transaction I am considering atm is:
The signature also signs the Pubkey Script and Amount (which together would represent what you reference as &quot;output of Tx&quot;).
Quoting the Transaction section of the Developer's guide:

Bob’s secp256k1 signature doesn’t just prove Bob controls his private
key; it also makes the non-signature-script parts of his transaction
tamper-proof so Bob can safely broadcast them over the peer-to-peer
network.


Image Source: Developer Guide: Transactions

As illustrated in the figure above, the data Bob signs includes the
txid and output index of the previous transaction, the previous
output’s pubkey script, the pubkey script Bob creates which will let
the next recipient spend this transaction’s output, and the amount of
satoshis to spend to the next recipient. In essence, the entire
transaction is signed except for any signature scripts, which hold the
full public keys and secp256k1 signatures.