I've recently picked up Android development myself so I can tell you what I know.
Generally when an app needs access to features it has to declare it in AndroidManifest.xml, or else the system throws exception when the app tries to access the feature. Also, even if the app declares permissions in detail (e.g. it wants to send/receive SMS), Android and Google Play will show the permission groups those permissions belong to (e.g. "phone calls and messaging", or something like that). In that sense when you look at the permission list displayed in Google Play or when installing you gain yourself a knowledge of the maximum this app is capable of doing.
There can be some exceptions, for example a feature not yet natively implemented in Android but by certain manufacturers, but as Android version grows later, these permissions should automatically get added to the apps requirement, even if the app does not explicitly state it. You still get the maximum knowledge.
If any veteran developer spot mistakes in what I said, please do point out, as I'm only a beginner in this field.