Sanitize skill names in injection metrics

codex-rs/core-skills/src/injection.rs

@@ -11,6 +11,7 @@ use codex_analytics::SkillInvocation;
 use codex_analytics::TrackEventsContext;
 use codex_exec_server::LOCAL_FS;
 use codex_otel::SessionTelemetry;
+use codex_otel::sanitize_metric_tag_value;
 use codex_protocol::user_input::UserInput;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_path_uri::PathUri;
@@ -135,11 +136,12 @@ fn emit_skill_injected_metric(
     let Some(otel) = otel else {
         return;
     };
+    let skill_name_tag = sanitize_metric_tag_value(skill.name.as_str());
 
     otel.counter(
         "codex.skill.injected",
         /*inc*/ 1,
-        &[("status", status), ("skill", skill.name.as_str())],
+        &[("status", status), ("skill", skill_name_tag.as_str())],
     );
 }
 

codex-rs/core/src/skills.rs

@@ -6,6 +6,7 @@ use codex_analytics::SkillInvocation;
 use codex_analytics::build_track_events_context;
 use codex_extension_api::SkillInvocationInput;
 use codex_extension_api::SkillInvocationKind;
+use codex_otel::sanitize_metric_tag_value;
 use codex_protocol::protocol::SkillScope;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_plugins::PluginSkillRoot;
@@ -87,6 +88,7 @@ pub(crate) async fn maybe_emit_implicit_skill_invocation(
     if !inserted {
         return;
     }
+    let skill_name_tag = sanitize_metric_tag_value(skill_name.as_str());
 
     for contributor in sess.services.extensions.skill_invocation_contributors() {
         contributor
@@ -106,7 +108,7 @@ pub(crate) async fn maybe_emit_implicit_skill_invocation(
         /*inc*/ 1,
         &[
             ("status", "ok"),
-            ("skill", skill_name.as_str()),
+            ("skill", skill_name_tag.as_str()),
             ("invoke_type", "implicit"),
         ],
     );