There is setParameterList method in the Query interface which allows creating constructs like:
WHERE id IN (?)

How is it possible to pass such an list to the SQL expression?

I mean criteria.add(Expression.sql ( " ... WHERE id IN (?) ..." ) )

This is not supported. Whats wrong with Expression.in() ?

Only one problem with Expression.in - I have no idea how to use it in my context.

I have Employees & Skills ... (yep, Gavin, you have already seen this -
http://forum.hibernate.org/viewtopic.php?t=925086 ) And I need to find all employees who has ALL of requested skills. This query works fine:

Criteria query = session.createCriteria(Employee.class)
.add(Expression.sql(
"( " +
" SELECT COUNT(es.skill_id) " +
" FROM EMPLOYEE_SKILL es " +
" WHERE es.employee_id = {alias}.employee_id AND" +
" es.skill_id in (65, 66, 67) " +
") = 3"
));

When I want to remove static skill list (65, 66, 67) and pass it as parameter - I'm in trouble.

I'm trying to use Criteria because of Example query API - I need search by name in addition to search by skills.

If you could propose a better way (or a more "Hibernate way")...

I think that these kinds of queries are much better expressed in HQL, which has full support for subqueries.