Can Skin Picker get you banned?
No — and you shouldn't take that on faith. Skin Picker never touches a game file, never injects code, never reads game memory, and can only ever select cosmetics your account already owns. Below is exactly how it works, what Riot's own documentation says, and the part I can't promise you.
Last updated 6 August 2026
The short answer
Skin Picker talks to the League Client through the local API the client itself exposes on your own machine. When it rolls a skin, it sends the same request the client sends when you click that skin yourself. It cannot select a skin you don't own, because it reads your collection and only rolls from what's in it.
What gets accounts banned is a fundamentally different category of tool: skin changers, which display skins you have not purchased. To do that they have to modify the game's files or inject code into the running game — which is precisely what anti-cheat is built to detect.
The three categories, and where each one stands
| How it works | Modifies the game | Shows content you don't own | Status |
|---|---|---|---|
| Memory injection — code injected into the running game process | Yes | Yes | Detected and actioned |
| Game file replacement — swapping model or texture files on disk | Yes | Yes | Against the terms of use |
| Client API — asking the League Client to change your own selection | No | No | What Skin Picker does |
The first two change what other players see, or show you content that was never bought. The third changes nothing that a player couldn't change by clicking in the client — it just does it faster, and with a dice roll.
What Riot's own documentation says
When Vanguard arrived in League of Legends, Riot published a FAQ for third-party developers. Two sentences matter here. Apps built on the client API, it states, “are still expected to work”. And: “External tools reading memory will no longer work.” That is the line — not “third-party tools” versus “no tools”, but tools that use the official local interface versus tools that read or modify the game.
You can read that page yourself rather than take my word for it: Riot's Vanguard FAQ for developers.
Skin Picker is also registered on the Riot Developer Portal, where the endpoints it uses are declared. That registration is currently under review. To be precise about what that does and doesn't mean: registering a product is not an endorsement, and Riot is explicit that it “does not constitute endorsement, certification or approval”. It means Riot knows the product exists and what it does.
What Skin Picker will never do
- Modify, replace or patch any game file
- Inject code into the game or read its memory
- Show you, or anyone else, a skin your account doesn't own
- Automate anything about how the game is played
- Reveal information the client doesn't already show you
The source code is public, so none of this has to be taken on trust — read it on GitHub.
What I can't promise you
Every page you'll find on this subject tells you it's 100% safe. Most of them are trying to sell you an account. Here is the honest version.
- Riot has no allow-list. They've said so plainly: no third-party tool is whitelisted, mine included. There is no certificate I can show you.
- The client API is not officially supported. Riot documents it as unsupported for third-party use and offers no guarantee it will keep working. A client update could break Skin Picker without warning — that's a functionality risk, not a ban risk, but it's real.
- Policies change. What's acceptable today was written by Riot and can be rewritten by Riot. If the rules move, this app follows them or stops.
- I am not Riot. Nothing here is a guarantee issued on their behalf. It's a description of what the software does, which you can verify in the source.
What about the Windows warning?
The installer isn't signed with a paid certificate yet, so Windows SmartScreen warns about it — as it does for any unsigned program, regardless of what it contains. That's a statement about a certificate, not about the software. Every release is built automatically from the public repository by GitHub Actions, so what you download corresponds to source code you can read. Code signing is being worked on.