Shy Guy's face

Due to their timidity, Shy Guys almost always wear masks, leaving the appearance of their true face unknown.

In a cutscene in Mario Power Tennis, Shy Guy trips on a stairstep, causing its mask to fall off. Its unmasked appearance is not seen on-camera, but Luigi is frightened by it. This supports the notion that Shy Guy's mask hides a dark secret.

Ghost Guy's face
Luigi's Mansion introduces enemies known as Ghost Guys, which are likely a subspecies of Shy Guys. A Ghost Guy must have its mask removed before it can be defeated, so players can easily see their face: two yellow eyes in a field of black, and a separate hole in the robe for the mouth.

However, it is unknown how closely related Shy Guys and Ghost Guys are, so it is not certain that this is how Shy Guys look without masks. Ghost Guys have several other minor differences in appearance from Shy Guys, so their faces could also differ.

Additionally, if the field of black is meant to represent an intense shadow, as opposed to a void within the robe, then the appearance of the surface of a Ghost Guy's face is still unknown. There are many enemies in the Mario franchise with their eyes set within a black void, but whether this is the case for Ghost Guys is not clear.

Their mask
In Mario Strikers Charged, Shy Guy's mask is shown to be able to emote like a face. Though the expression only changes while it is angled away from the camera, Shy Guy is not shown replacing the mask to do so.

A potential contradiction to this theory is that Shy Guys' masks are usually portrayed as removable, much more consistently than the one-off scene from Mario Strikers Charged. However, characters with detachable body parts are hardly a novel concept, so it isn't out of the question for the "mask" to still be its face.

Nothing
This theory claims that Shy Guys have no face, suggesting that they may wear face-like masks to appear as though they do.

Proponents cite the aforementioned Mario Power Tennis in-engine cutscene as evidence. If hacks or emulator tools are used to move the camera into position to see the unmasked Shy Guy, only a shaded portion of the robe and headband is visible. However, it is important to note that this angle was never intended to be seen in-game, and therefore should be taken with a grain of salt.

For performance and efficiency reasons, developers often avoid adding detail to parts of models that are never intended to be seen. For instance, the bulk of Mario's hair is usually not present on his models while he is wearing a cap. Were the cap edited out using third-party tools, the top of Mario's head would be absent, despite the fact that this is not how he looks without a cap. How Shy Guy looks without a mask is likely an analogous situation.