Net::SFTP::Foreign requires that all the arguments passed to its methods are untainted:

$opt_remote_dir =~ /^(.*)$/;
$sftp->setcwd($1);
$sftp->error and die "Unable to change directory: " . $sftp->error;
[download]