Google Apps Script determines the authorization scopes automatically

It is based on a scan of the code. Code that is commented out can still generate an authorization request. If a script needs authorization, you'll see one of the authorization dialogs shown here when it is run.