(-d) ? b(a({href=>"$_"},"[ $_ ]")) : a({href=>"$_"},"$_");
[download]

You're failing to escape the HTML for your directory and filenames. This can lead to weird things when people have filenames like <b>. Simply import escapeHTML, and add that in the appropriate places:

(-d) ? b(a({href=>"$_"},escapeHTML("[ $_ ]"))) : a({href=>"$_"},escape
+HTML($_));
[download]