The mask command should also prompt for the password if not specified.

The iteration count could also be hard coded to use a reasonable default and the salt dynamically generated from a secure random.

The code for the mask command can be found here.