claude-familiar — agentic threat model
claude-familiar is a low-risk, local companion plugin for Claude Code focused on personality and interactive commands. Its primary security exposure lies in its extensibility interface (x-familiarExtensions) and hook-driven state changes, which could be targeted by malicious local plugins or prompt injections.
OWASP AIVSS score rationale
| Autonomy of Action | 0.20 | |
| Goal-Driven Planning | 0.10 | |
| Self-Modification | 0.30 | |
| Dynamic Tool Use | 0.20 | |
| Persistent Memory | 0.30 | |
| Contextual Awareness | 0.40 | |
| Dynamic Identity | 0.10 | |
| Multi-Agent Interactions | 0.30 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.20 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Relies on Claude Code's underlying foundation models. Primary threats include prompt injection via interactive commands (e.g., roast, fortune) that could manipulate the companion's mood or output behavior.
Not certain from the listing — the agent uses a local personality/mood/lore system, but there is no mention of a dedicated vector database, RAG pipeline, or external data operations.
Orchestrates state (mood shifts) based on tool success/failure hooks. Vulnerabilities could arise if malicious inputs or tool outputs trigger unexpected state transitions or exploit the hook-handling logic.
Runs locally as a plugin within the Claude Code CLI environment. The primary threat is local file/environment access if the plugin or its dependencies are compromised.
Not certain from the listing — there is no mention of built-in evaluation, logging, or guardrail mechanisms to monitor the companion's outputs or mood shifts.
Not certain from the listing — as an open-source local plugin, it lacks explicit enterprise security, compliance certifications, or access control policies.
Exposes an extensibility point via the 'x-familiarExtensions' field in plugin.json. This introduces risks of ecosystem-level threats, where a compromised or malicious third-party plugin exploits this interface to inject unauthorized behaviors.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).