I NOTE THIS IS ALL WHAT CAN BE DONE - NOT AN INDICATION ITS EASY OR LIKELY. Most non-experts could not what you are asking, and many experts won't.
Its your friends network, so yes, if he has the technical nous and is so inclined he can spy on you in a limited way if he has set his network up to do so. I'll break it down -
It is his network, so the level of WIFI security is irrelevant - he knows the passphrase, and even if he doesn't - just like any ISP or provider between you and the sites you visit, he can get access to the data after it has left the WIFI network and is transiting his router.
Most websites now use HTTPS, and this does offer you some protection against spying. A rough and very simplistic general assessment is he will be able to see what sites you visit, but not exactly what pages. (Unless he manages to install his own certificate on your computer or you ignore computer warnings about untrusted certs). There are at least 2 ways he can gleen this information - By looking through the DNS requests your system makes, and by looking at the headers. Although sites are encrypted with HTTPS, most often the information about the site address is not encrypted due to limitations of having multiple secure sites on a single server/IP address.
Using a VPN will allow you to encrypt all traffic between your computer and him, and will overcome the shortcomings above - if you are careful not to use his nameservers - which is sometimes not obvious. Of-course, the VPN provider can get the data instead of him.
There is another attack vector - as you are at his place, he can likely get access to your hardware. Once he can do this he can install a key logger or other means of getting access to your systems. You may want to google "Evil Maid attack" for this class of problem.