Well, that's still a scary set of permissions. Application can be fine, but one has to be really careful with the scripts from the untrusted sources. It's not h

Well, that's still a scary set of permissions. Application can be fine, but one has to be really careful with the scripts from the untrusted sources. It's not hard to sneak something in a large enough file. Android 6 on-demand permission requests should somewhat fix this, but is still not a remedy. I've yet to see any scripting/automation tool that's able to run scripts properly sandboxed (generate APKs for them or otherwise obtain different UIDs with restricted just-enough permissions).