In order for applications to perform actions outside of their sandboxed environment the permission to perform that action must be granted at install time. These install time permissions are explicitly declared by an application author in the Android manifest file. This list is then presented to the user at install time to be accepted or rejected. If the permissions are rejected then the application is not installed. Otherwise, the application is granted every permission listed and installed on the device. An application’s permission list is therefore a good way to gauge an author’s intent versus the advertised intent. By defining an application’s capabilities, it also provides the capabilities of an attacker, should they subvert the application.