It is recommendable to let Net::OpenSSH quote the command arguments. Double references can be used to let some fragment pass unquoted:

my @cmd1 = (cd => $path_to_file);
my @cmd2 = (ls => '-a');
$ssh->system(@cmd1, \\'&&', @cmd2)
[download]

Otherwise, in case $path_to_file contained shell metacharacters it could produce undesired results or even be a security hole.

Note that currently, argument quoting expect some derivative of the Bourne shell on the remote side. Support for quoting arguments for other shells is in the works though.