From 6c00dc087e4c01312017389483573500001e9fe9 Mon Sep 17 00:00:00 2001
From: mandal-OAI <mandal@openai.com>
Date: Tue, 21 Jul 2026 19:20:58 +0000
Subject: [PATCH] Sanitize skill names in injection metrics (#34601)

## Why

Skill names may contain characters that are not valid in metric tag values.

## What changed

Pass skill names through `sanitize_metric_tag_value` before using them as the
`skill` tag on `codex.skill.injected` counters for both explicit and implicit
skill invocations.

GitOrigin-RevId: 0ed633fbd468739acc30193b566d830e20bc7860
---
 codex-rs/core-skills/src/injection.rs | 4 +++-
 codex-rs/core/src/skills.rs           | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/codex-rs/core-skills/src/injection.rs b/codex-rs/core-skills/src/injection.rs
index 3452f94e257e..74f6898353c4 100644
--- a/codex-rs/core-skills/src/injection.rs
+++ b/codex-rs/core-skills/src/injection.rs
@@ -11,6 +11,7 @@ use codex_analytics::SkillInvocation;
 use codex_analytics::TrackEventsContext;
 use codex_exec_server::LOCAL_FS;
 use codex_otel::SessionTelemetry;
+use codex_otel::sanitize_metric_tag_value;
 use codex_protocol::user_input::UserInput;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_path_uri::PathUri;
@@ -135,11 +136,12 @@ fn emit_skill_injected_metric(
     let Some(otel) = otel else {
         return;
     };
+    let skill_name_tag = sanitize_metric_tag_value(skill.name.as_str());
 
     otel.counter(
         "codex.skill.injected",
         /*inc*/ 1,
-        &[("status", status), ("skill", skill.name.as_str())],
+        &[("status", status), ("skill", skill_name_tag.as_str())],
     );
 }
 
diff --git a/codex-rs/core/src/skills.rs b/codex-rs/core/src/skills.rs
index 640e1825f653..628a9885aecf 100644
--- a/codex-rs/core/src/skills.rs
+++ b/codex-rs/core/src/skills.rs
@@ -6,6 +6,7 @@ use codex_analytics::SkillInvocation;
 use codex_analytics::build_track_events_context;
 use codex_extension_api::SkillInvocationInput;
 use codex_extension_api::SkillInvocationKind;
+use codex_otel::sanitize_metric_tag_value;
 use codex_protocol::protocol::SkillScope;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_plugins::PluginSkillRoot;
@@ -87,6 +88,7 @@ pub(crate) async fn maybe_emit_implicit_skill_invocation(
     if !inserted {
         return;
     }
+    let skill_name_tag = sanitize_metric_tag_value(skill_name.as_str());
 
     for contributor in sess.services.extensions.skill_invocation_contributors() {
         contributor
@@ -106,7 +108,7 @@ pub(crate) async fn maybe_emit_implicit_skill_invocation(
         /*inc*/ 1,
         &[
             ("status", "ok"),
-            ("skill", skill_name.as_str()),
+            ("skill", skill_name_tag.as_str()),
             ("invoke_type", "implicit"),
         ],
     );