See perltaint. The best approach is to either avoid invoking the shell by removing the redirection or to explicitly set up $ENV{PATH} to a trusted value. In your case, likely the following will suffice:

$ENV{PATH} = '/bin:/usr/local/bin';
[download]

If the external program perl1.pl will be sending mail, maybe you also need to add the directory where the sendmail program lives to the path.