Two thoughts:

1. IPC::Run will let you do shell-like piping without invoking the shell.
2. You could just quote the file names so the shell doesn't interpret special characters in them.