You usually can't detect them other than running the program and watching it die, or running the program with strace and looking for the files it's trying to stat/open.
You can actually pipe the output of strace into exodus and it will include the files that were accessed by the program in the bundle. For example:
strace -f nmap --script default 127.0.0.1 2>&1 | exodus nmap