Detect Hidden Prompt Injections in CVs with Gemini, Drive & Sheets

Detect Hidden Prompt Injections in CVs—Automatically with Gemini, Google Drive & Sheets

This n8n workflow screens uploaded CV PDFs for hidden-text and prompt-injection attempts by comparing Google Gemini’s text extraction verdict with Gemini Vision’s image-based verdict—then quarantines suspicious files in Google Drive and logs results to Google Sheets.

What this workflow does

• Receives applications via an n8n Form with candidate name, selected role, and a PDF CV upload.
• Validates file type: if the upload is not a PDF, the workflow rejects it and returns a rejection response.
• Runs Gemini on extracted text: the PDF is processed to extract raw text, which is sent to Google Gemini to generate a structured verdict (qualified flag, score, years of experience, and a one-sentence reason).
• Runs Gemini Vision on the rendered CV: the PDF is converted to a JPG (via ConvertAPI), then the image is sent to Google Gemini vision for the same structured verdict.
• Compares verdicts to detect tampering: it calculates divergence between text vs. vision outputs and flags the CV as suspicious if they disagree or exceed configured thresholds (including detection of hidden-text / prompt-injection attempts).
• Quarantines and alerts: if flagged, the original CV is uploaded to a Google Drive quarantine folder and a detailed Telegram alert is sent. If clean, it sends a “clean result” message using the vision-based reason.
• Logs everything: appends a row to Google Sheets (the “Applications” tab) with submission metadata, both scores, and divergence metrics.

Use cases

• SaaS HR pipelines that need automated detection of manipulated or hidden instructions inside applicant CVs.
• Teams using n8n to protect Gemini-based resume screening from prompt-injection risks.
• Operations workflows requiring auditable reporting in Google Sheets and instant Telegram notifications.

Technical details

• n8n nodes: if, set, form, merge, telegram, sticky note.
• Integrations: Google Gemini (text + vision), Google Drive (quarantine), Google Sheets (Applications log), Telegram alerts, and ConvertAPI for PDF-to-JPG rendering.