You're not risky for a SD card, but may be risky for others, using nsp or mod or something.
XCI or Nsp, before loading, they are just binaries, just like a photo file.
The only practical way to detect it's pirate software is to somehow calculate a hash code for it. But considering there're so many types of XCI (patched with DLC or updates or trimmed version). I won't bother to do so if I'm Nintendo.
By the way, owning a XCI is not crime, you are not going to be banned for owning it.