Portable shell escape dependency declaration for LaTeX packages

Package authors sometimes need to invoke external tools during compilation through \write18, but there is no widely adopted metadata mechanism to declare that dependency so engines and distributions can enforce or prompt for the correct permission level. While pdfTeX, XeTeX, and LuaTeX expose command-line flags to control shell escape, their default security postures differ, and the command whitelist available in restricted mode is not standardized across engines or distribution versions.

LuaTeX adds further ambiguity because its os.execute and io functions are governed by a security layer that does not align directly with the traditional \write18 restricted mode. A document that relies on shell escape may therefore behave differently depending on the engine and the local TeX installation, without any explicit warning to the user.

When a package genuinely requires shell escape—for example, to run a conversion tool at build time—the author cannot portably signal that requirement so the build system or user knows to adjust engine flags. This leaves the permission boundary implicit and dependent on distribution defaults.

Is there a documented or emerging convention for declaring shell escape dependencies in package metadata that works consistently across pdfTeX, XeTeX, and LuaTeX? How should authors reconcile LuaTeX's native os security layer with the engine-agnostic \write18 restricted mode? What configuration strategy keeps a project compilable when the local distribution defaults to restricted shell escape?