Inspect App Permissions: Manifest Declarations vs Current Grants

Read the package declarations

For an APK you own or may inspect, use Android's package-analysis CLI:

apkanalyzer manifest permissions app.apk

The output is a declaration inventory. It does not tell you whether a person accepted a runtime prompt or whether the app has special settings access on a particular device.

For a split-delivered app, keep the complete relevant artifact set and account for feature modules rather than assuming one file contains every declaration and behavior.

Inspect a controlled device separately

On a test device connected through authorized ADB, package diagnostics can help investigate installed state:

adb shell dumpsys package com.example.app

The output can be large and version-dependent. Review the relevant permission sections instead of scraping an arbitrary line number. Avoid posting a full device dump publicly; it may contain unrelated sensitive context.

Compare the three views

A permission missing from a settings screen is not automatically absent from the package. Some declarations are normal permissions or use different access mechanisms rather than a user-facing runtime switch.

Trace unexpected permissions to dependencies

Inspect the manifest merger report in the project to find which source contributed a declaration. Before removing it, identify the SDK feature that may depend on it. Rebuild and verify the final artifact after the change.

Keep the conclusion narrow

APKLint's Manifest Checker helps inspect declarations and potential risks. It cannot observe the current grants on your users' devices or determine all data collection from permissions alone. A complete privacy review also examines SDK behavior, server interactions and data that does not require a dangerous permission.