It's generally safer to catch a pokemon and then mod it for stats in pokehex.
If you download someone else's, as long as there isn't any data which conflicts (caught in the wrong place, hatched at the wrong level, came from the wrong game, moves they can't learn, same ID as others traded online, etc) they're legit/legit enough. Just be sure to reroll their IDs when cloning them in pokehex. Personally, If I have the same game, I'll generally give them my trainer name/id/secret id/gender as well with the previous person's stuff as the previous trainer name/gender. Works out fine as long as you pay attention to the details. I'm wary of those that say they're from previous games, but that's probably me just being overly cautious.
Even more safe to use cheat codes so all wild pokemon are shiny/perf IVs, as they are completely legit as far as the game is concerned.
I'll try and give away some dittos after this semester is over, to help out. Takes a bit of work, though. Trade from hacked to legit, then from legit to other legits, requires a lot of pokeballs on my legit account.