this tool is fully tested and ready to use for developers. We have plans to improve it in the future, so it is not the final version. This tool replaces the legacy SDK
The full documentation is presented in kb here -
http://devs.x-cart.com/misc/command_line_tool.html and in the utility help as well:
About the security. It could be used only if you have access to the server. So, if a hacker has an access to the server, he doesn't need this utility to harm your store. However, we will implement the ability deny updating this file during the upgrade procedure. As a result, you will be able to remove this file forever.
We decided to include into the default package since it is more flexible for the developers, webmasters and our support team to use this toll instead downloading it separately.