Fundamentally, it's not an issue of syntax. The problem is that the way commodity systems are set up, the capabilities of a script or program come from the environment in which it is run. There is no way that a user can easily tell what a script will do, even if it isn't malicious or doesn't have a code injection vulnerability.