🛡️ Sentinel: [CRITICAL] Fix command injection vulnerability in transcription tools

[badMade]

🚨 Severity: CRITICAL
💡 Vulnerability: Command injection and credential leakage vulnerability in tools/transcription_tools.py via _transcribe_local_command.
🎯 Impact: subprocess.run(command, shell=True) was used to execute a potentially untrusted local shell command (for local STT transcription) without sanitizing the environment variables passed to the child process. Because Hermes manages and caches API keys in the main process's environment variables, this exposed all of those secrets to the child process, allowing a compromised or malicious local STT command to trivially exfiltrate them.
🔧 Fix: Imported _sanitize_subprocess_env from tools.environments.local and applied it to the env argument of the subprocess.run call in tools/transcription_tools.py, ensuring sensitive environment variables are filtered out before being passed to the shell.
✅ Verification: Verified by inspecting the env payload dynamically during testing. I also verified the tests/tools/test_transcription_tools.py, tests/tools/test_transcription.py, and tests/tools/test_transcription_dotenv_fallback.py run locally and pass successfully.

---

PR created automatically by Jules for task 17536966523609946818 started by @badMade

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[github-actions]

🔎 Lint report: fix/transcription-command-injection-17536966523609946818 vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 8253 on HEAD, 8253 on base (➖ 0)

🆕 New issues (3):

Rule	Count
invalid-argument-type	3

First entries

run_agent.py:7317: [invalid-argument-type] invalid-argument-type: Argument to function `build_anthropic_client` is incorrect: Expected `str`, found `str | dict[Unknown | str, Unknown | str | dict[str, str]] | Any | ... omitted 3 union elements`
run_agent.py:13573: [invalid-argument-type] invalid-argument-type: Argument to function `_is_oauth_token` is incorrect: Expected `str`, found `str | dict[Unknown | str, Unknown | str | dict[str, str]] | Any | ... omitted 3 union elements`
run_agent.py:13576: [invalid-argument-type] invalid-argument-type: Argument to function `len` is incorrect: Expected `Sized`, found `(str & ~AlwaysFalsy) | (dict[Unknown | str, Unknown | str | dict[str, str]] & ~AlwaysFalsy) | (Any & ~AlwaysFalsy) | ... omitted 3 union elements`

✅ Fixed issues (3):

Rule	Count
invalid-argument-type	3

First entries

run_agent.py:13576: [invalid-argument-type] invalid-argument-type: Argument to function `len` is incorrect: Expected `Sized`, found `(str & ~AlwaysFalsy) | (dict[Unknown, Unknown] & ~AlwaysFalsy) | (Any & ~AlwaysFalsy) | ... omitted 3 union elements`
run_agent.py:13573: [invalid-argument-type] invalid-argument-type: Argument to function `_is_oauth_token` is incorrect: Expected `str`, found `str | dict[Unknown, Unknown] | Any | ... omitted 3 union elements`
run_agent.py:7317: [invalid-argument-type] invalid-argument-type: Argument to function `build_anthropic_client` is incorrect: Expected `str`, found `str | dict[Unknown, Unknown] | Any | ... omitted 3 union elements`

Unchanged: 4354 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[gemini-code-assist]

Code Review

This pull request mitigates a security vulnerability by sanitizing environment variables passed to child processes during local transcription. In tools/transcription_tools.py, the _transcribe_local_command function is updated to use _sanitize_subprocess_env to clean the environment copy before executing subprocess.run. Additionally, .jules/sentinel.md has been updated to document this vulnerability and its prevention. There are no review comments to address, and the implementation is correct.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.