I would say that if Warforged was made as a human by deafult that he does not have any penalties for using disguise as a generic human(hell, I would give him advantage on the check for simply being recognised as a human)
It's not comparing like with like, and a warforged that is built to look human could, with the aid of a disguise kit, impersonate a human without penalties. If the warforged didn't look remotely human (which is entirely up to the player) then it could never impersonate a human, no matter how good the disguise.
Thus, such a warforged would by necessity need to be able to convincingly pass themselves off as a human. If that could not be achieved within an acceptable rate of success, then no such warforged would have been created with their envoy tool as a disguise kit. Wars don't need make-up artists. They need effective spies and scouts.
EDIT: I can see the warforged needing the same time to create a disguise as anyone else. Perhaps they are making the fake skin and wig and stuff like a 3D printer. It wouldn't be as quick as a changeling. But I also don't think it would be like a different kind of Warforged using a normal disguise kit. A warforged envoy with a racial disguise kit tool would be more effective and robust, allowing them to pass as human or appropriately sized demi-humans. I don't think regular warforged using a regular disguise kit could pull off a similar disguise.
Here I disagree with you. An envoy warforged is a warforged. There's nothing in the racial write-up of envoy that would suggest that an envoy with a built-in disguise kit gets any kind of special benefit when disguised as a member of another race.
They get a built-in disguise kit (however you reflavour it).
And they're already better at it than
any other warforged, as they get
double their proficiency bonus when using their built-in kit. (I initially thought bard and rogue warforged could match their mastery with chosen tool through Expertise class feature, but they actually can't -- Expertise covers only skill checks and, for rogues only, thieves' tools.)
Now, the rules for disguises are anything but clear. If you go by the PHB, in the section on using ability scores (pp. 177-178), it would seem like
creating a disguise is an Intelligence (Disguise Kit) check, and trying to pass yourself off in disguise a Charisma (Deception) check. But XGtE then muddles things by saying that copying a
humanoid's appearance is DC 20.
So, apparently in RAW, there is no penalty, disadvantage or increase in DC when trying to pass off as a member of another race. And, as such, a warforged inflitrator would have an easier time to pass off as a human than another human. Which, IMO and with all due respect, is silly.
I'd say when you disguise yourself, the quality of the disguise is determined by a Intelligence (Disguise Kit) roll. DC set by the DM, with as much granularity as the DM is willing to deal with (same race, disguising as a member of another sex, races similar in appearance, etc.). If you pass the check, your disguise is good enough not to raise suspicion on appearance alone. Further success depends on various Charisma skills (mainly Deception, but other could be useful as well -- Perform, for example), maybe occasionally used with Intelligence instead of Charisma.
I
would give warfoged some kind of penalty on their attempts to disguise as members of other races. The same I'd apply to dragonborn trying to pass off as human, for example. Or a human trying to pass of as warforged. The envoy's integrated tool benefits would give him an edge in such situations, but he wouldn't be as good as passing off as human as another human. OTOH, a warforged would have an easier time trying to disguise himself as a shield guardian, golem, or other similar creatures.
There's nothing in Masque's description implying she's good at disguising herself as human. It just says she's built for infiltration, to blend in and assassinate. She could do that by posing as another warforged. There were a lot of them built, and they were found in armies of all nations.
But, it would all be a lot easier if we had better rules for disguise. This way, it's according to the DM's interpretation. Which means we're all correct. And likely wrong, at the same time
I apologise if the post came out difficult to follow. I started replying this morning, and then continued returning to it when I could get away from work.