Because it's in one use call, it's relatively easy to extract--just pull out everything between use Module::Metadata and the next semicolon, rework it into something a bit safer, and eval it. Or even better, reval it. That's the approach the module's extract_metadata function takes--it constructs a very restrictive Safe container, massages the code into a call to Module::Metadata->new, and evalutes it in the Safe container.

        $safe->permit_only(qw(:base_core :base_mem));
        $safe->deny(qw(repeat range));
[download]

The actual code is a bit more complicated than this, because it handles nesting and (basic) quoting correctly in case a future metadata field accepts a coderef or something, but that's the gist of it. It also responds to use Module::Metadata 1.0 (version numbering) correctly by calling Module::Metadata->VERSION.

By the way, thanks for mentioning interoperability. I should add in a field for operating systems.

=cut
--Brent Dax
There is no sig.