Generally speaking, you have to be root for things to install. You could download a static binary or other non system critical executing program and install into a user's directory, however, it still can't harm the system. Just the user's account, and only if mailcious. As already mentioned, spyware is rare and wouldn't last long in Linux. Get a good firewall, don't run as root (for security and the peace of mind that you can't accidentally hose your system), turn off all uneeded services (and keep up to date on services you need w.r.t security updates) and you are good to go.