Yes aegis capa question, only allow unknown origin capas. Or entries that use capas that cannot be gained without abusing the system like unrestricted system-ui or led notification would need....
What is and isn't "abuse" is entirely a matter of opinion. Entries should be able to use any and all capabilities necessary if it makes for a more groundbreaking app.