You haven't checked to see whether the Net::SFTP::Foreign->new(...) call succeeded. If it fails, then $sftp won't be a hash reference.
You don't appear to have passed the password on. Do you need to ?

The documentation recommends using $ftp->error() to check that the new() call has succeeded:

$sftp = Net::SFTP::Foreign->new($host);
$sftp->error and die "unable to connect to remote host: " . $sftp->err
+or;
[download]

Cheers,
Rob