Move your downloaded .pkg game files into the packages folder.

If you go online with a CFW console while a pirated PKG is installed, yes—risk is high. Always disable syscalls (e.g., using WebMAN MOD ’s “unload” feature) before signing into PSN.