I've seen scripts like this
Be aware of bots that steal account details .... And eventually withdraw your winnings.
I never use bots anyway, manual is the way to play
If you don't trust it, don't use it, but you can check the code before running it and as much as you can see there is no Address inside the code or any withdraw mentioned, huh?
It's insanely easy to obfuscate code or call another page that gives a command to withdraw or send your auth token. So yeah... Be VERY careful or just use an alternate account with only the money you need to bot or test bot.