I hate it when that happens. IF (and it's a big if) everything is as you describe third-hand, the victims' group wants mental health to save the day with both hands tied behind its back, and will blame your friend if anything bad happens. Where do they get these people?
Can't give you/her any legal advice per se, but let's go over what you said she said they said. I don't see any remote "duty" that your friend would have to keep confidential the name of the potential victim or the nature of the alleged threat UNLESS the state you're in has a very specific law sayng this (or perhaps the issue is revealing her location, which may be a different issue). Your friend is not (one assumes) the potential victim's therapist, and thus has no clinician-patient duty of confidentiality (sounds "legal," I know, but DO NOT consider this real legal advice). When people call me and say they have important information but I can't tell anyone (or they won't tell me who they are), I tell them to call someone else (it happened again last week -- actually, I tell them something more colorful). The main "ethic" here may be whether to deal in rumor and innuendo (which isn't fair) or to attempt to corroborate and act as best one can in the interest of decreasing danger while preserving the person's rights. (Note that if your friend is not the prisoner's therapist, I don't see any particular duty to him, either.)
Is she sure this info really came from a "victim services group"? or might it have come from someone who just doesn't want him to get out of prison and doesn't have any real evidence of threats? "Poison pen letters" sometimes come by phone, or even computer.
If your friend has to make a recommendation, I suggest she do her best to gather as much info as possible (corroborated when possible, and not limited to the kind of prisoner he is -- that's probably not where he committed his crime), then if she believes she can provide a risk assessment, go ahead, with lots of disclaimers. I suggest such things not be called "predictions." If the issue is not really a psychological one (e.g., if it has to do with social or criminal behavior outside a mental or emotional context), it may be best simply to say "It's not psychological, so I can't say one way or the other."
A few correctional jurisdictions, including the Federal prison system, can mandate certain kinds of monitoring (including MH care) after a person completes his sentence. Most jurisdictions can't however, and the civil commitment process is the only protection for those who haven't committed further crimes. Remember, the commitment process requires BOTH dangerousness (for this kind of commitment) AND mental illness, and the danger generally should arise from the illness. Thus mean people are not generally candidates for commitment just because they like to stab or rape; they have to do it because of a mental illness (and not "antisocial personality disorder"). Commitment judges can be "flexible" of course, but when they over-commit, the "patient" may have a pretty good case for wrongful imprisonment.
The best advice for your colleague (well, the best I have at the moment): (1) Contact a lawyer herself to discuss her actions and duties. (2) Get a second opinion about the potential dangerousness of the prisoner (Gutheil: "Never worry alone." ... wish I'd said that). (3) Be sure the risk assessment sticks to issues within her field and is as valid as feasible. (4) Don't let some "victim services group" bully her into doing something she thinks is not right (but get some legal advice -- I imagine the Department of Corrections where she works has lots of lawyers who can help).
P.S., if she'd like a copy of a chapter I just wrote on evaluating violent patients, currently in press for a book by Dr. Ken Tardiff, ask her to e-mail me with her mailing address -- reidpsychiatry@compuserve.com