I think it can be solved by untainting the constants returned by subs registry_directory and registry_file in Spoon::Registry. I don't see an easy way to do that. One could possibly override them -- they're called as methods -- or one could replace registry_path, the method that uses them, with one that returns an untained value:

{
   my $registry_path = '/path/to/registry.dd';
   my ($u_registry_path) = $registry_path =~ /(.*)/;

   {
      no warnings 'redefine';
      *Spoon::Registry::registry_path = sub { $u_registry_path };
   }
}
[download]