The best way to do this is best described in the thesis that Eelco Dolstra wrote describing Nix. I suggest you read that. tl;dr: Clear the environment, know wh

The best way to do this is best described in the thesis that Eelco Dolstra wrote describing Nix. I suggest you read that. tl;dr: Clear the environment, know where all of the system headers are, control the build environment of the dependencies. Basically, knowing dependencies means controlling them. But to expand on that, an interpreter could do some basic checking like: * Does the command reference a path that the build system doesn't know about? * Does the build system know where the executable is for the command, and is it well-known? Things like that. It won't be perfect, but it would be better. And it can get better with time.