Hash, as anamethatisnt said, is just to confirm nothing's corrupted.

Without knowing how to read code, best you can do is check the issues section, the number of "stars" in the repo (similar to likes), if the AppImage is provided by someone other than the original author (common when the original project doesn't include an AppImage), and other indirect signs.

If you know a bit of troubleshooting, not to be confused with knowing how to code, you could also download the AppImage to a virtual machine, cut all direct communications of the virtual machine to the internet and to the host machine, and unpack the AppImage to see if any files are amiss.

Alternatively, but that also requiring some knowledge of troubleshooting, you could ask a LLM to make an "AppImage recipe" for the program you want and it should explain step by step how to make the needed AppImage. And troubleshooting comes into play because you better check at each step if it isn't hallucinating or linking you to shady sites (latter extremely rare in my experience but better than to trust blindly).