if you want to return the results of the select,
then you need a bit more complexity. Also,
dbms_sql is difficult to work with and a bit
outdated for what you want.
CREATE TABLE ABC (A  NUMBER);

insert into abc values(1);
insert into abc values(9);
insert into abc values(13);
insert into abc values(999);

CREATE OR REPLACE PACKAGE ref_cur_tst
IS
   TYPE t_cur IS REF CURSOR; 

   PROCEDURE get_abc (cv_cur IN OUT t_cur, p_list IN varchar2);
END ref_cur_tst;
/
CREATE OR REPLACE PACKAGE BODY ref_cur_tst
AS
   PROCEDURE get_abc (cv_cur IN OUT t_cur, p_list IN varchar2)
   IS
   BEGIN
      OPEN cv_cur FOR 'SELECT a FROM abc where a in ('||p_list||')';
   END get_abc;
END ref_cur_tst;
/

set serveroutput on;

DECLARE
   a       abc.a%TYPE;
   cv_c1   ref_cur_tst.t_cur;
   p_list  varchar2(20) := '1, 9';
BEGIN
   ref_cur_tst.get_abc (cv_c1, p_list);

   LOOP
      FETCH cv_c1 INTO a;
      EXIT WHEN cv_c1%NOTFOUND;
      DBMS_OUTPUT.put_line (a);
   END LOOP;
   CLOSE cv_c1;
END;
/
the way I've shown here is frowned upon because it doesn't use bind variables, so worse performance.