I'd include the shell as one of the tools we use on a regular basis. If I use a command like scp with wildcards in the input path, and the files that are returned contain colons, for example[0], the fact that the shell doesn't quote every file with a space or colon in its name before passing it off to scp is a deficiency in the shell, which gets reflected when scp refuses to copy it.

[0] https://stackoverflow.com/questions/14718720/how-can-i-scp-a...

It is also an unavoidable problem with GNU make and an easy to make mistake when writing CMake files. These tools should have required quoting up-front so filenames are never seen without them but it's a bit late in the day now to suggest fixing this.