If you are downloading the
.apk files from unknown/untrusted sources, there's no easy way to judge. Most Anti-Whatever solutions (anti-virus, anti-malware, etc.) are just ruling by "database entries" (i.e. they have a database of known malware, and check whether the package name matches), or only check requested permissions (and not whether e.g. a SMS app only sends the SMSs you wish). I've never heard about a "real" heuristics scanner analyzing an app's behaviour.
Though it might theoretically be possible a "scanner" also verifies a kind of checksum (as the mentioned MD5), this could only work against a "trusted base" like e.g. Playstore. For apps not available there it would fail then (nothing to compare). And even for apps available there, it would need to check against the very same version. Such a solution is hardly practical.
So while my arguments might differ, my bottom line is almost the same as geff's: Only install from trusted sources. While nothing is 100% secure, this imposes the smallest risks possible. The highest risk is with pirated stuff, as that's very likely to have "bad things" injected.