How to tell if third party apps are authorised/legitimate

Is there a list of authorised apps, or otherwise a way to fully understand what permissions an app has access to?

e.g. If an app says it can view my stash, does that also include the ability to manipulate it? Or would that be a separate permission/never allowed?

I don't think there's any way for a third party tool to manipulate the stash without faking user input while in game - which would be illegal.

Legit tools are limit to what the user web UI can do either directly or via the API. Old tools that use a poe session ID can do anything you can while logged into the website; these generally should be avoided* now since if malicious could do a lot of harmful things. New tools use an API provided by GGG and have you login using OAUTH on the POE site are limited to things GGG wants tools to be able to do which means a read only stash.

* The only legit tool I'm aware of still doing things the old way is POB for it's somewhat deceptively named "Trade for these items" search (which actually searches for what POB things would be best in slot, not what a potential build guide is recommending). I'm not sure if there's a major technical issue blocking them doing so at this point, or if it was a pet feature created by 1 person who left he project and no one else cares because it's so niche a function.