In terms of safety it goes in this order:
Color, reflection, injection
Color bots, as the name specifies, looks for color coordinates within the game.
Reflection reads the codes that the client already has installed, like item, npc codes, etc.
Injection, sends data to the bot.
I don't think any credible bot client still uses injection because it's easy to detect.
I'm not by any means advanced in java, but I do remember these things from past experience.