This function works reasonably well to figure out whether a variable will be disliked by the taint checks automatically enabled by setuid execution:
sub tainted { ! eval { join('',@_), kill 0; 1; }; }
and in particular, never does any system calls.