Whenever I look for an app in Play Store, the description states the list of required permissions.

Is that list up to what the developer declares, or is it automatically generated in some way?
In other words, can that list be not representative of what actually happens?

If so, is there an alternative way to get a reliable such list?

Whenever I look for an app in Play Store, the description states the list of required permissions.

1. Is that list (taken from the Manifest?) up to what the developer declares, or is it automatically generated in some way?
   In other words, can that list be not representative of what actually happens?

2. If so, is there an alternative way to get a reliable such list?