Maybe you missed it in the post, they look for the value of an environment variable and send the obfuscated result. I'm guessing this particular variable isn't sensitive for most users, but the reality that they find it acceptable to snoop your environment and hide their tracks is a big red flag.