The way to prevent malicious code from damaging files in your home directory is to not run it using your account. Create a separate_user that doesn't have any special permissions and run code under that UID until you've determined whether or not you can trust it.
Most code I run, that has the potential to be malicious, is niche scientific applications that install via
sudo apt-get install suspect_program. apt-get will give the suspect_program root access during install. The code can therefore run anything malicious it wants anywhere it wants on my system.
How does running the code under a seperate_user account protect any other accounts on my Ubuntu Linux box? I already gave the suspect_program root access when I installed the darn thing.