well, actually it should be...

my $quoted_to = text_to_shell_lit($to);
system 'scp', '--', $from, "${host}:$quoted_to";
[download]

or

my $quoted_from = text_to_shell_lit($from);
system 'scp', '--', "${host}:$quoted_from", $to;
[download]