How can one open a specific tab in preferences via Terminal?

So I know I can use open /System/Library/PreferencePanes/Keyboard.prefPane to open Keyboard preferences. But how can I open the 'Shortcuts' tab specifically?

You can use AppleScript from Terminal using osascript:

osascript -e "tell application \"System Preferences\"" -e "set the current pane to pane id \"com.apple.preference.keyboard\"" -e "reveal anchor \"shortcutsTab\" of pane id \"com.apple.preference.keyboard\"" -e "activate" -e "end tell"

Replace ‘shortcutsTab’ with one of ‘keyboardTab’, ‘InputSources’, ‘shortcutsTab’, ‘Text’, ‘Dictation’ or ‘keyboardTab_ModifierKeys’ to change the tab it opens.

To find the list of available tabs in other preference panes, use
osascript -e "tell application \"System Preferences\"" -e "set the current pane to pane id \"com.apple.preference.name\"" -e "get the name of every anchor of pane id \"com.apple.preference.name\"" -e "end tell" where ‘name’ is the name of the preference pane.

To select a specific category of shortcut, you can use System Events to select a row from the left table.

osascript -e "tell application \"System Preferences\"" \
          -e   "set the current pane to pane id \"com.apple.preference.keyboard\"" \
          -e   "reveal anchor \"shortcutsTab\" of pane id \"com.apple.preference.keyboard\"" \
          -e "end tell" \
          -e "tell application \"System Events\"" \
          -e   "tell application process \"System Preferences\"" \
          -e     "repeat while not (window 1 exists)" \
          -e     "end repeat" \
          -e     "tell window 1" \
          -e       "repeat while not (row 1 of table 1 of scroll area 1 of splitter group 1 of tab group 1 exists)" \
          -e       "end repeat" \
          -e       "select row i of table 1 of scroll area 1 of splitter group 1 of tab group 1" \
          -e     "end tell" \
          -e   "end tell" \
          -e "end tell" \
          -e "tell application \"System Preferences\"" \
          -e   "activate" \
          -e "end tell"

‘i’ is the index (counting from 1) of the row in the left column of the preference pane tab. The new lines (using ‘\’ on the previous line) and white space outside of speech marks are just for formatting and can be omitted.

Be careful of the use of ‘repeat while not’ which waits for System Preferences to open to the necessary page, however this freezes the code until that point, and if System Preferences is preoccupied with something else such as logging in to iCloud which can't be interrupted, this will freeze until you manually quit.

Further to the answer from @grgarside (I don't have sufficient reputation to post this as a comment, sorry) not all IDs match the pattern com.apple.preference.name (which tripped me up for a while).

As of macOS Sierra (10.12.2) there are 19 preference pane IDs that match that pattern, 8 that match the pattern com.apple.preferences.name (note the s) and two outliers (com.apple.prefs.backup and com.apple.Localization).

To get the ID of the current pane (that you already have open in System Preferences) use:

osascript -e "tell application \"System Preferences\"" -e "get the ID of the current pane" -e "end tell"

To get every available ID use:

osascript -e "tell application \"System Preferences\"" -e "get the ID of every pane" -e "end tell"