We use the following -- with a separate (modified) EA to collect en0, en1, and en2 (we have MacPros with two ethernet ports along with wifi), so we get everything we might need.

#!/bin/bash

en=`networksetup -getmacaddress en0 | awk '{print $3}'`

case $en in
    The)
    echo "<result>No port found</result>" 
    ;;  

    *)
    echo "<result>$en</result>"
    ;;
esac

That's funny. I thought I posted to this the other day. What I meant to post was that its not actually necessary to grab the Secondary MAC address to do searches on it. If you do either a simple search or an Advanced Search with the "MAC Address" criteria, paste in the Secondary MAC address and it will pull up the Mac associated with it. I'm certain of that.
However, if the reason for the EA is to be able to include both primary and secondary MAC addresses in a report as distinct columns, then an EA will be your friend.

Thank you!
I also got these to work for our purposes:
1.
echo "<result>$(system_profiler SPAirPortDataType | awk '/MAC Address:/ {print $NF}')</result>"

2.

!/bin/sh

wifiPort=networksetup -listallhardwareports | awk '/Hardware Port: Wi-Fi/,/Ethernet/' | awk 'NR==2' | cut -d " " -f 2
macAddy=networksetup -getmacaddress $wifiPort | awk {'print $3'}

echo "<result>$macAddy</result>"

or (as you can use the 'Hardware Port' name as well as the 'Device' name)

#!/bin/bash

macAddy=`networksetup -getmacaddress "Wi-Fi" | awk '{print $3}'`

echo "<result>$macAddy</result>"

exit 0