Can you check if the application is privileged before showing the message ?
That would let you change the code to add the permDescription:

// Show developer description of the permission if the application has been considered
// as reviewed (privileged / certified).
if (detail.appType == 'privileged' || detail.appType == 'certified') {
  str += detail.permDescription;
}

I think apps/system/js/permission_manager.js is the only consumer of |isApp| so I won't mind if you change |isApp| by |appType|