Prompt-injection scanner for Zapier AI

Where multimodal PI enters Zapier workflows

Gmail trigger → AI Step for invoice or receipt extraction. A Zap triggered by a new Gmail email with an attachment that passes the attachment to an AI Step for data extraction is among the most common Zapier + AI patterns. Invoice images, receipt scans, and form PDFs are all untrusted external inputs. An attacker who can email your Zap trigger address can craft an attachment containing adversarial pixel-level instructions. See PDF prompt-injection detection for the version where the image is embedded in a PDF.

Typeform / JotForm / Gravity Forms image upload triggers. Web forms that accept image uploads — customer onboarding forms, support ticket attachments, product submission forms — route those images to downstream AI Steps for classification, extraction, or triage. The form submitter is an external, untrusted user. An adversarial form submission is a straightforward attack vector: the attacker simply fills in the form and uploads a crafted image.

Google Drive / Dropbox new file triggers with AI document analysis. Zaps that trigger on new files in a shared folder and pass those files to an AI Step for summarisation or extraction have a supply-chain attack surface. The files arrive from anyone who has write access to the shared folder — collaborators, clients, vendors, or anyone who gains access to a shared link. A file placed in the trigger folder that contains an adversarial image payload processes silently, with no notification to the Zap owner.

Slack image share triggers. Zapier's Slack trigger can fire on new file uploads in a channel. If the Zap forwards the file to an AI Step for any kind of processing — content moderation, classification, or transcription — any channel member can upload a crafted image to trigger the attack. In B2B SaaS tools that route customer-shared images through AI pipelines via Slack webhooks, this is a common unguarded path.

Webhook trigger with base64 image payload. Custom webhook triggers that receive base64-encoded image data from external services (e-commerce product images, user avatar uploads, camera feeds) and forward to an AI Step have the same exposure as any direct API integration. The indirect prompt injection via image pattern applies when the image URL is fetched from a third-party host.

Adding a Glyphward scan action to a Zap

Zapier's "Webhooks by Zapier" action can call any REST API. The scan gate requires three Zap actions: a Webhooks POST, a Code step to read the score, and a Filter.

Step 1: Add a "Webhooks by Zapier" action between the trigger (or the step that produces the image) and the AI Step.

Configure it with:

Action Event: POST
URL: https://glyphward.com/v1/scan
Payload Type: JSON
Data:
  image: [the base64 image field from the upstream step]
  source: zapier_workflow
Headers:
  Authorization: Bearer [your Glyphward API key]
  Content-Type: application/json

Step 2: Add a "Filter by Zapier" action after the Webhooks step.

Only continue if:
  [Webhooks response: score]   Less than   70

If the score is 70 or above, the Zap stops at this Filter and the AI Step never runs. The Zap run is marked "Stopped by Filter" in your Zap history — useful for auditing flagged inputs without triggering an error alert.

Step 3: Store your API key securely. Use Zapier's built-in "app" credential storage or a Zapier Secret Manager connection rather than pasting the key directly into the Webhooks action header field. This prevents the key from appearing in Zap history logs.

Get early access

Alternative: Code by Zapier (JavaScript)

If you need to handle the scan response with custom logic (multi-image Zap, conditional routing based on scan_id, or logging to a data store), use a "Code by Zapier" JavaScript step instead of the Filter:

const imageBase64 = inputData.imageBase64; // from upstream step
const apiKey = inputData.glyphwardApiKey;   // pass as input from Zapier Secret

const resp = await fetch('https://glyphward.com/v1/scan', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ image: imageBase64, source: 'zapier_code_step' }),
});

if (!resp.ok) {
  // Fail-closed: block the Zap if the scan service is unreachable
  throw new Error(`Glyphward scan failed: ${resp.status}`);
}

const result = await resp.json();

if (result.score >= 70) {
  throw new Error(
    `Image blocked by multimodal PI scanner. scan_id=${result.scan_id} score=${result.score}`
  );
}

return { scan_id: result.scan_id, scan_score: result.score, image_safe: true };

Throwing from a Code by Zapier step halts the Zap run with an error, which Zapier retries according to your Zap's error handling settings. For production Zaps, configure a separate error-handling Zap (Zapier's "Catch Hook" trigger on error) to route flagged scans to a Slack notification or a Google Sheet audit log.

Coverage matrix

Related questions

Further reading

• FigStep detection — the typographic attack class most commonly exploited in automation pipelines.
• PDF prompt-injection detection — scanning invoice and document attachments from Gmail triggers.
• Indirect prompt injection via image — PI payloads in remotely-fetched images from Drive or webhook URLs.
• For n8n automation — comparable integration guide for n8n, the open-source Zapier alternative.
• For Dify agents — integration guide for Dify, another widely-used visual workflow builder.
• For Flowise agents — no-code agent builder integration.
• Why text-only scanners miss image prompt injection — architectural background.