select 'root' as username, plist.value as shell, os_version.* from (select * from plist where path = '/var/db/dslocal/nodes/Default/users/root.plist' and key = 'passwd' and value = '*') has_no_passwd, os_version, plist where plist.path = has_no_passwd.path and plist.key = 'shell';

does that return true if you haven't set the password?