diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..4b53157
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,5 @@
+## 2026-09-02 - Sentinel: Mitigate Command Injection Vulnerability in transcribe.ts
+
+**Vulnerability:** In `apps/zettel/src/tools/transcribe.ts`, the `binaryAvailable` function used `sh -c command -v ${bin}` which was susceptible to command injection if the `bin` argument (derived from `process.env.WHISPER_BIN`) contained shell metacharacters.
+**Learning:** Even when reading from environment variables, interpolating strings into shell execution wrappers (`sh -c`) can expose systems to command injection vulnerabilities. `execFileSync` without `shell: true` should be preferred.
+**Prevention:** Avoid using shell interpolation to evaluate environment variables or command-line arguments. Instead, use an argument array to pass executable names securely. For checking binary existence on `$PATH`, `execFileSync("which", [bin])` safely prevents shell execution by relying directly on the `which` executable and standard IO bindings.
diff --git a/apps/zettel/src/tools/transcribe.ts b/apps/zettel/src/tools/transcribe.ts
index a67d019..e74cadd 100644
--- a/apps/zettel/src/tools/transcribe.ts
+++ b/apps/zettel/src/tools/transcribe.ts
@@ -41,8 +41,7 @@ function binaryAvailable(bin: string): boolean {
   // Absolute/relative path → just check the file.
   if (bin.includes(path.sep)) return fs.existsSync(bin);
   try {
-    // `command -v` resolves builtins/PATH entries; argv array, no shell injection.
-    execFileSync("/usr/bin/env", ["sh", "-c", `command -v ${bin}`], { stdio: "ignore" });
+    execFileSync("which", [bin], { stdio: "ignore" });
     return true;
   } catch {
     return false;