Check the Knox counter status, if it's showing "0x0", that means it's clean and hasn't been tampered with. That's part of what Knox was intended for, to ensure nothing sneaky like a keylogger has been installed in the system root. If the Knox counter is showing "0x1" or something else, don't touch it. Knox uses a hardware e-fuse, which if tripped by tampering can't be reset.
Factory reset the phone of course before using it.