Definitely not a trigger lock. My first thought was it's a key chain. It is about the right size, but the loop doesn't open.

I don't think CSSA would send anyone something that is prohibited.