There are a couple of possible approaches, here is one
<Target Name="DoHideCommand">
<Exec Command="MSBuild $(MsBuildThisFile) /t:SpecialCommand /nologo /noconsolelogger"/>
</Target>
<PropertyGroup>
<MyCommand>dir c:</MyCommand>
</PropertyGroup>
<Target Name="SpecialCommand">
<Exec Command="dir"/>
</Target>
This invokes a seperate msbuild process to invoke the actual target, and hides all output resulting in
...
DoHideCommand:
MSBuild test.targets /t:SpecialCommand /nologo /noconsolelogger
...
And here is another one
<Target Name="SpecialCommandViaFile">
<PropertyGroup>
<TmpFile>tmp.bat</TmpFile>
</PropertyGroup>
<WriteLinesToFile File="$(TmpFile)" Lines="$(MyCommand)"/>
<Exec Command="$(TmpFile) > NUL 2>&1" WorkingDirectory="$(MsBuildThisFileDirectory)"/>
<Delete Files="$(TmpFile)"/>
</Target>
This creates a batch file to run the actual command, then redirects all output to NUL so only this is shown:
...
SpecialCommandViaFile:
tmp.bat > NUL 2>&1
Deleting file "tmp.bat".
...
Note though that the one executing your msbuild file can always simply open your file to look at the credentials, even if they are hidden from the output when running it.