This function works reasonably well to figure out whether a variable will be disliked by the taint checks automatically enabled by setuid execution:
sub tainted {
! eval { join('',@_), kill 0; 1; };
}
and in particular, never does any system calls.