skill.injected metric tag value not sanitized — skills with ":" in name are dropped (tag value contains invalid characters)

Version

• codex-cli 0.137.0 (rust)
• opentelemetry rust sdk 0.31.0
• [otel] exporter enabled (otlp-http)

What happens

When a skill whose name contains a colon is injected into a session, Codex fails to record the codex.skill.injected metric and emits a WARN log instead:

metrics counter [codex.skill.injected] failed: tag value contains invalid characters: myplugin:myskill

A colon is a legitimate separator in plugin-namespaced skill names (<plugin>:<skill>), so every plugin-provided skill triggers this on injection. The metric is silently dropped and one WARN is logged per occurrence.

Expected

Codex should sanitize/escape metric tag (attribute) values that contain characters disallowed by the metrics backend — e.g. replace or strip them — so codex.skill.injected is recorded rather than dropped. Alternatively, document the allowed character set for skill names/tag values.

Impact

• codex.skill.injected is lost for all plugin-namespaced skills, leaving a blind spot in skill-usage metrics.
• WARN-level log noise on the OTel pipeline for every injection of such a skill.

Repro

1. Register/install a plugin-namespaced skill so its name contains a colon (e.g. myplugin:myskill).
2. Enable OTel ([otel] with any exporter).
3. Start a session where that skill is injected.
4. Observe the WARN above; no codex.skill.injected data point is emitted for it.