A 10-second Python install is only the first layer
Our sandbox installed 46 packages in 10 seconds and occupied 64 MB. The build check then succeeded in 1 second. Those figures make the Python environment look modest, but they do not describe the job Rose performs on a player's PC. Rose watches the League client, runs a local WebSocket bridge, downloads skin files, builds on Pengu Loader, and injects assets when the game process starts. Each boundary can change independently of the Python package set.
The appeal is easy to understand. Rose puts locked-skin previews, chroma selection, custom mods, saved choices, and random selection inside champion select. Party mode can share selections with up to 10 lobby members through a Cloudflare relay. The README says the modifications are local and confer zero competitive advantage. Treat that as the project's description, not a promise from Riot or proof that a future anti-cheat update will accept the same behavior.
Pytest passed 3 checks before an X display error stopped collection
Our test command ended after 2 seconds with 3 passed and 1 collection or setup error out of 4. The failing module, test_pengu_loader.py, attempted to connect through Xlib and received an empty display name. The log supports a precise finding: the checked-out tests do not collect cleanly in a headless Debian container. It does not show a failed skin injection, because League, Windows, and a graphical session were absent.
Pip-audit found 51 known vulnerabilities in the installed environment. The supplied results do not break that number down by severity or prove that every affected package is reachable during normal use. Fifty-one is still too large to wave away in software that runs with elevated rights and modifies a game installation path. Before using Rose, identify the affected dependencies, check whether the release installer contains them, and remove the program cleanly if that review is not possible.
Windows 10 or 11 carries the real setup cost
The README limits Rose to Windows 10 or 11 and tells users to run its installer as Administrator. It also requires an injection DLL that the repository cannot distribute because of DMCA restrictions. Users must obtain that file from an authorized source and sign it with their own code-signing certificate. That is a material barrier, not a final checkbox, and it moves trust outside the repository we reviewed.
Building from source adds Python 3.11 or newer, Visual Studio Build Tools, WPF support, the .NET Framework 4.7.2 targeting pack, and Inno Setup 6 for an installer. The documented scripts compile the vendored Pengu Loader 1.1.6 before packaging Rose. Our 1-second build result came from the lab's fresh Debian check and cannot validate that Windows toolchain, the signed DLL, Vanguard compatibility, or a real game launch.
Version 1.3.1 arrived one day after patch-related repairs
Rose 1.3.1 was published on September 24, 2026, and fixes skin reapplication after a crash plus a reconnect-screen control. Version 1.3.0, released less than 1 hour earlier, fixed injection after League patch 16.19 and added troubleshooting for missing or outdated patcher files. This pace shows direct maintenance, while also showing how tightly Rose follows changes in the client and its injection path.
The repository was pushed on September 24 and had 582 stars with 17 open issues and pull requests when fetched on September 25. Issue 285 reports Pengu Loader deactivating when League opens, despite reinstall attempts and antivirus exclusions. Issue 281 reports an LTK Patcher error after Rose switches to an already owned skin. These are specific current reports, not proof that every user is affected, but both touch the main match-start workflow.
Analytics calls home every 15 minutes unless disabled
With analytics enabled, Rose sends a random installation ID and app version to its own service at startup, every 15 minutes while present, and on a best-effort close event. The README says the identifier does not come from the Windows Machine GUID and documents a source setting that disables analytics. The API and raw activity are maintained outside the public client repository, so source inspection of Rose cannot cover the receiving service.
Riot's developer documentation says League Client API use by third-party applications is not officially supported, and its general policy expects products using that API to be registered. Rose's README separately says the project is unaffiliated and that users proceed at their own risk. For a disposable test setup, that may be an acceptable experiment. On a valued account, the combination of administrator access, external injection code, 51 dependency advisories, and patch-sensitive behavior is a poor trade.