Can Skin Picker get you banned?
No, and you shouldn't take my word for it either. Skin Picker never touches a game file, never injects code, never reads game memory, and can only ever select cosmetics your account already owns. Here's how it works, what Riot's documentation actually says, and the parts I can't promise you.
Last updated 6 August 2026
The short answer
Skin Picker talks to the League Client through the local API the client itself exposes on your own machine. When it rolls a skin, it sends the same request the client sends when you click that skin yourself. It cannot select a skin you don't own, because it reads your collection and only rolls from what's in it.
What gets accounts banned is a different category of tool entirely: skin changers, which display skins you have not purchased. To do that they have to modify the game's files or inject code into the running game. That is precisely what anti-cheat is built to detect.
The three categories, and where each one stands
| How it works | Modifies the game | Shows content you don't own | Status |
|---|---|---|---|
| Memory injection: code injected into the running game process | Yes | Yes | Detected and actioned |
| Game file replacement: model or texture files swapped on disk | Yes | Yes | Against the terms of use |
| Client API: asking the League Client to change your own selection | No | No | What Skin Picker does |
The first two change what other players see, or show you content that was never bought. The third changes nothing a player couldn't change by clicking around in the client. It just does it faster, and at random.
What Riot's own documentation says
When Vanguard arrived in League of Legends, Riot published a FAQ for third-party developers. Two sentences matter here. Apps built on the client API, it says, “are still expected to work”. And: “External tools reading memory will no longer work.” That is where the line sits. Not third-party tools on one side and no tools on the other, but tools that go through the official local interface against tools that read or modify the game.
You can read that page yourself rather than take my word for it: Riot's Vanguard FAQ for developers.
Skin Picker is also registered on the Riot Developer Portal, where the endpoints it uses are declared. That registration is currently under review. Don't read more into it than there is: Riot says plainly that registering “does not constitute endorsement, certification or approval”. It means Riot knows the product exists and knows what it does.
What Skin Picker will never do
- Modify, replace or patch any game file
- Inject code into the game or read its memory
- Show you, or anyone else, a skin your account doesn't own
- Automate anything about how the game is played
- Reveal information the client doesn't already show you
The source code is public, so none of this has to be taken on trust: read it on GitHub.
What I can't promise you
Every other page on this subject swears the thing is 100% safe. Most of them are trying to sell you an account. So, honestly:
- Riot has no allow-list. No third-party tool is whitelisted, mine included. There is no certificate I can show you.
- The client API is not officially supported. Riot documents it as unsupported for third-party use and offers no guarantee it will keep working. A client update could break Skin Picker overnight. That's a risk to whether it works, not to your account, but it's real.
- Policies change. What's acceptable today was written by Riot and can be rewritten by Riot. If the rules move, this app follows them or stops.
- I am not Riot. Nothing here is a guarantee issued on their behalf. It's a description of what the software does, which you can verify in the source.
What about the Windows warning?
The installer isn't signed with a paid certificate yet, so SmartScreen warns about it, the way it warns about any unsigned program, whatever that program contains. The warning is about a certificate, not about the software. Every release is built automatically from the public repository by GitHub Actions, so what you download matches source code you can read. A signing certificate is on the list.