If you want to define them as custom attributes, you would have to extend the jBPM code, yes.
It's probably a lot easier to just define an additional task parameter that contains your data. So it will be similar to properties like Comment and Priority, but the data will simply be stored as a task parameter, as part of the ioSpecification of the userTask. This would not require you to extend the code itself, as tasks allow you to define additional task parameters out of the box. You can then use this parameter in your handler by doing workItem.getParameter(name).
Assuming you're defining your processes in XML, I would suggest taking a look at how properties like Comment and Priority get saved in the BPMN2 XML, so you can do something similar for your parameter.
Kris