1. the Meta Data is enough for that.
2. Your SDK Version in the NCA corresponds to the leaked March2018 SDK.
3. You literally said you used the SDK for that.
4. It would be really awesome, if you really build an open source NCA/NSP Builder that works perfectly. I know, that there's no such tool yet. I'm very active in the Scene and would know, if there were a legal alternative.
Sorry man, but this is how it is.
If you're interested in building a completely legal NSP, wait for SimonMKWii's NCA Builder.
This Builder even uses a Custom String for the "SDK Version".