The program outputs your site-specific password to stdout. Is it possible for an attacker to get your stdout history?

Might be. Some terminal emulators save logs. "Unlimited scrolling" often goes to disk, possibly in a file, possibly in swap (Terminal.app makes it stay in memory, which once consumed 3GB of RAM for my long-lived "rails server" tab). iTerm2 allows you to navigate back in time, while Terminal.app saves some data on quit to display on restore (if OSX autosave is enabled).

When you allow less common tools to be used, one could use the bash or zsh read-builtin to read the master password without echoing (e.g. dash's read can not do that) and use xclip or similar to directly put the password into the X clipboard. With xclip's -l option you could even automagically "forget" the clipboard after it was pasted once.