Add password to keychain from command line without showing them
I went ahead and wrote a small command line app to do it for you programmatically, here it is, finally pipe-able console password entry :)

Other options:

If you run security add-generic-password ... -w then it will prompt you for your password, you can type it in there, that doesn't leak anything.

There are a few hacks to feed the secure prompt, but just using it is OK too (or use the GUI).

In my case (attempting to feed kinit) it can integrate with the keychain, though still a manual initial entry, built-in.