ResumeGuard AI is an educational Red/Blue security lab built to demonstrate how untrusted resume content can manipulate LLM-powered hiring systems. The Red Team side generates resumes containing invisible prompt injections and submits them to a naive Gemini-based HR screener. The attack demonstrates how malicious instructions embedded inside resume content can influence an LLM and trigger unintended tool actions through Nodemailer. The Blue Team side implements a defense pipeline using input sanitization, XML-style untrusted-data delimiters, hardened system prompts, and an application-level SMTP interceptor. The model is explicitly prevented from owning or directly controlling email capabilities, while unauthorized tool calls are blocked and surfaced as security alerts. The system includes a React + Vite frontend, Node.js + Express backend, Google Gemini function calling, Nodemailer, and PDF processing with pdf-lib and pdf-parse. The project provides a complete attack → trace → defense workflow with configurable injection counts, payload libraries, run timelines, API endpoints, and automated Red/Blue test harnesses.